rwngwn

Extended API security checklist derived from real-world pen-test findings. Adds 5 specific check patterns on top of OWASP Top 10 -- broken AuthZ model, IDOR, mass assignment, JWT non-invalidation, and missing input validation. Load this when scanning Node.js/Next.js/Express APIs.