PASS: 350 package files scanned; no detected secrets or forbidden files.
PASS: base paths, configured API marker, no application loopback, original backend sources and package scan.