clawbot
5a81d23dfe
check / check (push) Waiting to run
The default blocklist covers the IPv4 private and reserved ranges, IPv6 loopback, unique local and link-local addresses, and public addresses that hand credentials, user data or bootstrap material to whatever can reach them, without the caller presenting anything. A provider's other public addresses, such as 161.26.0.0/16 and 166.8.0.0/14, are not refused: they hand out no credentials that way, reaching them can be legitimate, and every cloud has some, so a partial list would promise coverage it does not give. The README's egress section and the comment above blockedNetworks now state this rule, naming the same material as the rule above alwaysBlockedNetworks, so nobody infers wider coverage and a future candidate can be accepted or refused against it. No list change. Model: opus-5-5