Run a bounded deterministic preflight scan for possible private keys, secret assignments, permissive CORS, debug mode, insecure HTTP, and invalid JSON. Not a comprehensive security audit.