Use only on a lab server you own or are authorised to manage (a local VM is ideal).
Run the check, fix findings one at a time, and record each change in HARDENING_LOG.md.
