We detect compliance exposure before fines do.
Public-surface analysis only. No access, no intrusion.