scanning-attack-surfaces

Review what a target exposes and what it is allowed to do, in two modes -- a GitHub/GitLab repository's hosting-platform configuration surface (branch protection, required reviews/checks, Actions/CI permissions, unpinned actions, webhook and deploy-key inventory, token scopes, secret-scanning status), reported per item as Covered/Partial/Gap; or an individual artifact (a deterministic gate, CI workflow, MCP server, subagent definition, or cloud service integration), asking whether its outbound interface or its own credential and permission scope goes further than its function requires. Use when auditing standing hosting configuration, or an artifact's own steady-state exposure and privilege design. Distinct from evaluating-deterministic-gate-quality (grades a gate's placement and bypass consequences, not its exposure or privilege scope), screening-a-low-trust-contribution (screens one incoming diff, not steady state), and scanning-ci-workflows (reports two analyzers' full findings over a workflow set).