Against a live application's public surface (given its domains or endpoints), flush out error-handling defects observable from the outside - leaked internals, wrong status semantics, server faults on benign input, framework-default error pages - using only unauthenticated, non-mutating, polite requests that observe how the app responds, never exploit it, until the reachable surface is exhausted.