qa-security-smoke-tests

Basic security smoke tests — auth/authz, validation, leaks in errors/logs, rate limiting (if enabled), SSRF/XSS where relevant.