Web systems prevent bypassing authentication (alternative access paths, URL manipulation, cookie manipulation, code injection), privilege escalation and cross-site scripting; R1 performs black-box security audits in development and before production; R2 advanced audits; R3 further protection for ALTA.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.