- Introduce a new `sec-check` CLI command that runs built‑in security checks (audit logging, SSO, MFA, token expiry, etc.) and reports PASS/FAIL results with remediation details.
- Add a `-o` flag to export check results as structured JSON for archiving, tracking, or dashboard integration.
- Provide an extensible framework for community‑contributed custom checks via a simple ID/description/run pattern.