Answer about thirty plain-language questions about what you're building, what it can touch, and whose account it signs in with. Get back your blast radius, the three things worth fixing first, and five attack paths run against your own configuration.
Nothing leaves your browser. No account, no storage, no network calls — the whole engine runs on this page. Roughly fifteen minutes.