Scoring rubric: clarity and correctness of technical steps, appropriateness of tools, realism of assumptions, and depth of security reasoning.