Build it.
Understand it.

A useful report distinguishes a completed check from an area it could not inspect.

Removing a credential from the latest file is different from invalidating it.

Access controls need to hold at the data boundary, not just in the interface.

Interrupted work needs an honest state and a recoverable path.

What matters is whether the server authorizes the action.

Specific findings and visible gaps are more useful than a single reassuring number.