Features & Editing

- features.yaml defines categories (locking, encryption, exfiltration, etc.). Each has keywords and optional regex.
- Update features.yaml in S3 post-deploy to change runtime behavior; repo copy serves as default.
- suggestions.yaml maps detected features to defensive actions displayed with classification results.

Runtime Edit Flow
1. Edit the file in S3 (same bucket as processed artifacts).
2. Redeploy Lambda or rely on next cold start to pick up changes, depending on caching.


