Finds sensitive data exposure risks — PII/secrets written to logs, over-returning API responses, data at rest without encryption, sensitive data in URLs, test fixtures with real data, secrets in git history, and temporary/backup file leaks. Use when auditing how a project handles, stores, logs, or transmits sensitive data.
