⚡ passive only — we read public data, no probes touch your servers. checks: SSL · headers · DNS (SPF/DMARC/DKIM) · subdomains · breach exposure · common misconfigs.