I tested the admin surfaces against production, with read-only rules for real data and a separate test school for anything that writes. I handed the developers a prioritized report with evidence and acceptance criteria for every finding, then fixed several defects myself through reviewed pull requests. Across Phases 1 and 2: i found 28 defects, 8 of them Critical.