Threat model, detection rules, canaries, findings and reports. No LLM or framework dependencies.