Authorized Web & API Attack-Surface Review

Runs 11 tools in one pass against one URL - tech stack, CMS, and WAF fingerprinting, header analysis, then CORS, GraphQL, OAuth, WebSocket, Host header, API fuzz, and WAF test-case generators. Every step runs unconditionally, matching this app's other web-exposure workflows - the reference's own active-testing consent gate is not replicated here since this app's workflow engine has no such gating concept (see the batch 6 comment above). The OAuth, WebSocket, API Fuzz, and WAF Test steps never send a request to your target themselves - they return a checklist/test-case list to replay yourself.