Lucas van Staden ProxiBlue

Full-page fetches only — MANDATORY (blanket, not just security)

Never use WebFetch (or any tool that pre-summarizes a page). Fetch the raw page and read it in full yourself. This applies to EVERY fetch — security scans, module/version checks, and general research/citation lookups alike. Widened 2026-08-11 from an advisory/CVE-only rule after the user made clear the same blind spot risks silently dropping content during research, not just security scans.

Why this exists

WebFetch's own tool description says it plainly: fetches the URL, converts HTML to markdown, processes the content with a small, fast model, and "results may be summarized if the content is very large." That intermediate model decides what's relevant before you ever see the page — on a long document it can silently drop a section.

2026-08-11 incident: a Claude instance in the lcd-mageos container was asked to check a security advisory URL against installed Amasty modules. It used WebFetch (internally referred to as "ctx_search" /

	#!/bin/bash
	# /bin/rm + /usr/bin/rm + /usr/local/bin/rm — wrapper that trashes instead of deleting.
	#
	# Why: 2026-06-29 incident — gitnexus-rebuild cron rm -rf'd .git on
	# 3 projects. Moving to trash instead makes those mistakes recoverable.
	#
	# Installed via dpkg-divert: real coreutils rm moved to /bin/rm.real,
	# this wrapper at /bin/rm (and /usr/bin/rm via the Ubuntu usrmerge symlink).
	# That means EVERY caller — interactive, scripts, cron, even direct
	# /bin/rm — hits this wrapper. No bypass.