Allowlist DevFridge official domains (false positive)

[mikeminer]

Summary

Allowlist the DevFridge apex and its currently deployed first-party hosts after a Phantom false-positive warning began affecting the entire domain family.

Why this is a false positive

• None of these hosts appears in the current Phantom blocklist.yaml, fuzzylist.yaml, eth-blocklist.yaml, or nft-blocklist.yaml.
• All listed hosts resolve over HTTPS and currently return HTTP 200.
• The public source is https://github.com/mikeminer/devfridge.
• The security policy is https://docs.devfridge.cool/security and the canonical contact directory is https://connect.devfridge.cool.
• DevFridge is a non-custodial Solana Token-2022 timelock. Program ID: 9RY54dNPYTzDyh3TfFqDdt2b2KMM56KW1tw9erRTGQo6.
• A recent finalized mainnet program transaction is visible at https://solscan.io/tx/3tjKUjUsSLx7tScTZRycCXcs8SrmEh4Kin2bBWqie549EHM4BwzrLJoCBQSREHD3gQYzkJJWT5GrxRMRF3JAhHNK.
• The sites never request a recovery phrase, private key, password, or custody of user wallets. Wallet actions use the injected provider and remain user-approved.

Scope

The change deliberately lists exact active hosts rather than a wildcard: the apex plus team, scan, docs, connect, sdk, health, world, bot, agent, osint, and pasta subdomains.

Validation

• yarn install --frozen-lockfile --ignore-scripts
• yarn build
• Confirmed every listed host returns HTTP 200 over HTTPS on 2026-09-01.

Summary by CodeRabbit

• New Features
  • Added devfridge.cool and its listed subdomains to the whitelist.
  • Kept nftplus.io available on the whitelist.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: e775b0d6-a441-424e-a25a-dd987cdfcad7

📥 Commits

Reviewing files that changed from the base of the PR and between 5030186 and 79f1f78.

📒 Files selected for processing (1)

• whitelist.yaml

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📝 Walkthrough

Walkthrough

The whitelist now includes nftplus.io and multiple devfridge.cool subdomains. The existing nftplus.io entry remains present.

Changes

Whitelist domains

Layer / File(s)	Summary
Add whitelist entries whitelist.yaml	The whitelist includes nftplus.io and devfridge.cool endpoints for team, scanning, documentation, connection, SDK, health, world, bot, agent, OSINT, and pasta services.

Merge Risk: ⚪ Minimal · up to 79f1f

This is a localized allowlist update with no actionable merge-blocking risk remaining after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: adding DevFridge official domains to the allowlist to address a false positive.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

Warning

⚠️ This pull request has been flagged as potential spam (promotional) by CodeRabbit slop detection and should be reviewed carefully.