How do I security test a Windsurf-built project?

Deploy the application to staging, scan the live URL, run static analysis, and manually test authorization boundaries. UNPWNED's currently enabled outside-in Deep Scan with up to 702 configured checks spans 33 coverage scanners plus a supporting endpoint-discovery pass after current ownership proof and covers externally observable header, TLS, DNS, exposure, dependency, endpoint, CORS, form, rate-limit, and error-disclosure signals.