check / check (push) Waiting to run
configs/config.example.yml allowlisted github.com and user-images.githubusercontent.com, where anyone can put an image, so a deployment set up as Getting Started says served those images to anyone without a signature. The example now leaves allowlist_hosts out, with one commented entry under example.com. Getting Started and "Running under upaas" in README.md say that every image on an allowlisted host is served without a signature, so an allowlisted host must be one the operator controls. Model: opus-5-5