overreach

Catch code that overreaches its capabilities — network calls, subprocess spawns, sensitive-file reads, curl|sh, and hardcoded secrets — in a diff, file, or repo.