Skip to content

Synchronize repository#250171

Merged
samczsun merged 1 commit into
MetaMask:mainfrom
security-alliance-bot:db0f9b8e-25f3-413c-996a-e674992d966e
May 24, 2026
Merged

Synchronize repository#250171
samczsun merged 1 commit into
MetaMask:mainfrom
security-alliance-bot:db0f9b8e-25f3-413c-996a-e674992d966e

Conversation

@security-alliance-bot

@security-alliance-bot security-alliance-bot commented May 24, 2026

Copy link
Copy Markdown
Collaborator

This is an automated pull request to synchronize this repository with the latest configuration


Note

Low Risk
Single-domain deletion in a static config list with no application logic changes.

Overview
This automated sync removes blast-voucher.com from the domain blocklist in src/config.json. No other entries or files change in this diff.

Reviewed by Cursor Bugbot for commit 3135d54. Bugbot is set up for automated code reviews on this repo. Configure here.

@samczsun samczsun added the blocklist addition Issue or PR requesting addition of a domain to the blocklist label May 24, 2026
@samczsun samczsun merged commit 1c94baf into MetaMask:main May 24, 2026
6 checks passed
@security-alliance-bot security-alliance-bot deleted the db0f9b8e-25f3-413c-996a-e674992d966e branch May 24, 2026 15:55

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

Reviewed by Cursor Bugbot for commit 3135d54. Configure here.

Comment thread src/config.json
"14coinbase.com",
"camp-network.com",
"krek-en-log.pages.dev",
"blast-voucher.com",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Phishing domain removed from blocklist without justification

Medium Severity

blast-voucher.com was removed from the phishing blacklist. This domain follows the same naming pattern as other blocked Blast-related phishing domains still in the list (e.g., sol-blast.com, claims-blastup.pages.dev, blast.airdropsalert.live). Removing it means users will no longer be warned when visiting this potentially malicious site. Worth confirming this removal is intentional and the domain is genuinely no longer a threat.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 3135d54. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

blocklist addition Issue or PR requesting addition of a domain to the blocklist

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants