Security audit. OWASP Top 10 + STRIDE threat model. 17 known false-positive exclusions to reduce noise.
