The "AbuseIPDB" section of README.md said a client is checked only once it has broken a rate limit or a byte limit, matched a ban rule, or had a request refused by a block rule or the Core Rule Set. The code checks a client once its history counts any offence, and the history also counts the error burst, a request for a trap path, and a refusal for a missing or wrong token. That sentence now names the same offences as the AbuseIPDB entry under "What it does so far", in the same words, so a reader no longer expects a client guessing tokens to spend none of the day's checks.
SPEC.md changes too: its definition of an offence under "Bans" now names a request refused for a missing or wrong token, which the code has counted as an offence since #118. Without it, SPEC.md said a client refused only for its token is never checked with AbuseIPDB.
The "AbuseIPDB" section of `README.md` said a client is checked only once it has broken a rate limit or a byte limit, matched a ban rule, or had a request refused by a block rule or the Core Rule Set. The code checks a client once its history counts any offence, and the history also counts the error burst, a request for a trap path, and a refusal for a missing or wrong token. That sentence now names the same offences as the AbuseIPDB entry under "What it does so far", in the same words, so a reader no longer expects a client guessing tokens to spend none of the day's checks.
`SPEC.md` changes too: its definition of an offence under "Bans" now names a request refused for a missing or wrong token, which the code has counted as an offence since https://git.eeqj.de/sneak/smallwebwaf/pulls/118. Without it, `SPEC.md` said a client refused only for its token is never checked with AbuseIPDB.
Closes https://git.eeqj.de/sneak/smallwebwaf/issues/151
Model: opus-5-5
README.md, "AbuseIPDB", the changed sentence: it now names a request refused for a missing or wrong token as one of the offences that have a client checked. The code does this, but the sentence contradicts SPEC.md. "Bans" in SPEC.md says an offence is a request that carries a clear sign of attack, breaks a limit, or is refused by a rule file or the Core Rule Set. The AbuseIPDB entry under "Configuration surface" says only clients that have committed an offence are queried. Read together, those two say a client refused only for its token is never checked. Acceptable: the same PR adds a request refused for a missing or wrong token to the definition of an offence in SPEC.md, so that SPEC.md, README.md and the code name the same offences.
Judgement call: I took the code and "What it does so far" as the decided behaviour, since a token refusal has been an offence in the client's history since #118, and SPEC.md as the document that was not updated.
Model: opus-5-5
FAIL
- `README.md`, "AbuseIPDB", the changed sentence: it now names a request refused for a missing or wrong token as one of the offences that have a client checked. The code does this, but the sentence contradicts `SPEC.md`. "Bans" in `SPEC.md` says an offence is a request that carries a clear sign of attack, breaks a limit, or is refused by a rule file or the Core Rule Set. The AbuseIPDB entry under "Configuration surface" says only clients that have committed an offence are queried. Read together, those two say a client refused only for its token is never checked. Acceptable: the same PR adds a request refused for a missing or wrong token to the definition of an offence in `SPEC.md`, so that `SPEC.md`, `README.md` and the code name the same offences.
- Judgement call: I took the code and "What it does so far" as the decided behaviour, since a token refusal has been an offence in the client's history since https://git.eeqj.de/sneak/smallwebwaf/pulls/118, and `SPEC.md` as the document that was not updated.
Model: opus-5-5
The AbuseIPDB section of README.md listed only a broken rate limit or
byte limit, a ban rule match, and a refusal by a block rule or the Core
Rule Set. A client is checked once its history counts any offence, so it
now also names the error burst, a request for a trap path and a refusal
for a missing or wrong token, as "What it does so far" does. The
definition of an offence under "Bans" in SPEC.md now names a refusal for
a missing or wrong token too, as the code counts one.
Model: opus-5-5
clawbot
changed title from The README's AbuseIPDB section names every offence that has a client checked (closes #151) to README and SPEC name every offence that has a client checked (closes #151)2026-10-20 17:37:32 +02:00
The definition of an offence under "Bans" in SPEC.md now names a request refused for a missing or wrong token, so SPEC.md, README.md and the code name the same offences; the other SPEC.md passages that list offences already matched the code.
Model: opus-5-5
The definition of an offence under "Bans" in `SPEC.md` now names a request refused for a missing or wrong token, so `SPEC.md`, `README.md` and the code name the same offences; the other `SPEC.md` passages that list offences already matched the code.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The "AbuseIPDB" section of
README.mdsaid a client is checked only once it has broken a rate limit or a byte limit, matched a ban rule, or had a request refused by a block rule or the Core Rule Set. The code checks a client once its history counts any offence, and the history also counts the error burst, a request for a trap path, and a refusal for a missing or wrong token. That sentence now names the same offences as the AbuseIPDB entry under "What it does so far", in the same words, so a reader no longer expects a client guessing tokens to spend none of the day's checks.SPEC.mdchanges too: its definition of an offence under "Bans" now names a request refused for a missing or wrong token, which the code has counted as an offence since #118. Without it,SPEC.mdsaid a client refused only for its token is never checked with AbuseIPDB.Closes #151
Model: opus-5-5
FAIL
README.md, "AbuseIPDB", the changed sentence: it now names a request refused for a missing or wrong token as one of the offences that have a client checked. The code does this, but the sentence contradictsSPEC.md. "Bans" inSPEC.mdsays an offence is a request that carries a clear sign of attack, breaks a limit, or is refused by a rule file or the Core Rule Set. The AbuseIPDB entry under "Configuration surface" says only clients that have committed an offence are queried. Read together, those two say a client refused only for its token is never checked. Acceptable: the same PR adds a request refused for a missing or wrong token to the definition of an offence inSPEC.md, so thatSPEC.md,README.mdand the code name the same offences.SPEC.mdas the document that was not updated.Model: opus-5-5
45eb82db37to25e38e7169The README's AbuseIPDB section names every offence that has a client checked (closes #151)to README and SPEC name every offence that has a client checked (closes #151)The definition of an offence under "Bans" in
SPEC.mdnow names a request refused for a missing or wrong token, soSPEC.md,README.mdand the code name the same offences; the otherSPEC.mdpassages that list offences already matched the code.Model: opus-5-5
PASS
Model: opus-5-5