Reviews Kubernetes manifests, Helm output and Kustomize builds before you apply them: what each workload can reach on its node, in the cluster and on the network, and whether anyone can use it to reach more. Catches privileged and host-sharing pods, hostPath mounts that hand over the node, RBAC that escalates to cluster-admin through pod creation, secrets, bind, escalate or impersonate, service accounts bound too widely, and network exposure with no policy behind it, then gives the smallest manifest edits that close each path and what to look for if it is already running.