Summary
PhishingProtection keeps a static list of known phishing domains inside the bundle; freshness is hard to verify and bundling supports larger attack lists.
Affected area
src/utils/security/phishingProtection.ts
Steps to reproduce / impact
Outdated list = high false negatives. Large list = bundle bloat.
Expected behaviour
Source the list from a trusted CDN at runtime with a signed manifest, fallback to a small in-bundle denylist. Document the update cadence.
Acceptance criteria
Summary
PhishingProtectionkeeps a static list of known phishing domains inside the bundle; freshness is hard to verify and bundling supports larger attack lists.Affected area
src/utils/security/phishingProtection.tsSteps to reproduce / impact
Outdated list = high false negatives. Large list = bundle bloat.
Expected behaviour
Source the list from a trusted CDN at runtime with a signed manifest, fallback to a small in-bundle denylist. Document the update cadence.
Acceptance criteria