Defensive, non-destructive API security auditing toolkit. Safe checks only — no exploitation, no brute force, no data-mo