Phase 7: Harden It

Write the four security tests and watch each one fail before making it pass. Run the security pass and fix or justify every finding. Measure the query count and the render profile, fix the single worst offender in each, and record the before and after. Do the keyboard pass and the phone-on-mobile-data pass. Write down anything you decided not to fix and why, because a known and stated limitation is professional and a hidden one is not.