One authorized vulnerability report for one affected asset/version. I review read-only local or staging evidence and return a private triage packet with demonstrated versus theoretical impact, remediation steps, and regression-test guidance. No credentials. No live probing. No production changes. No bounty guarantee. No certification claim.