Scenario 1
You just claimed an airdrop
Risk: Claim sites can sneak in a token delegation that lets another address spend your tokens later.
With Kestrel: Kestrel lists every active delegate and unknown token so you can revoke before anything moves.
Scan a busy wallet