Firewall rule analyzer

This is static analysis of one pasted export. It cannot connect to a firewall or cloud account, so it does not know what is actually deployed, which rules a stateful engine short-circuits through connection tracking, or what your references and service tags resolve to. Rules with negation, custom-chain jumps, interface or connection-state matches, referenced security groups, or Azure service tags are listed as not compared rather than guessed about. AWS security groups have no rule order, so they get redundancy and exposure checks only. Findings describe the export as written; fixing them still needs a review and a deploy on your side.