v0.2.0

Adds AI-app exposure checks for private-looking secrets, public frontend env names, unsigned Stripe webhooks, missing Firebase rules, Supabase RLS evidence, debug API routes, and AI usage guardrails. Also updates README positioning around defensive static scanning for authorized repos.