One coordinated hardening pass across roughly twelve products in a day: SSRF guards, money-path races, moderation gates, and new test suites everywhere. Every repo got a backup tag first. We hack our own stuff; this was the scheduled version.
Nine repos got LICENSE, SECURITY.md, CONTRIBUTING, and a hardened .gitignore on the same day. Boring and deliberate, and the reason every later hardening pass had somewhere to write its report.