Reviews public or shared AI-backed web endpoints for abuse, excessive cost, data exposure, unsafe browser control, weak request limits, and missing human approval. Use before launching or materially changing an HTTP or API endpoint that can invoke an AI model. Do not use as a penetration test, compliance certification, or substitute for runtime monitoring and professional security review.