[#2] Network policy default-allow exposes all public egress (incl. cloud metadata IP)

[utksh1]

network_policy.py:444-452: when SECUSCAN_NETWORK_ALLOWLIST is empty, the engine adds allow rules for 0.0.0.0/0 and ::/0. The default denylist does not contain 169.254.169.254 (cloud metadata) unless the operator adds it, so SSRF to http://169.254.169.254/ is permitted by the policy layer. IPv6 is unconstrained by a typical IPv4-only denylist.

Fix: ship a default denylist with link-local/metadata ranges and require an explicit allowlist for non-internal targets.

[utksh1]

Hey @S0412-2007, this issue matches your skills. Would you like to take it on? Comment below and I'll assign it to you once you accept the collaborator invite.

[S0412-2007]

Hi @utksh1
It's my pleasure to receive your invitation.
I kindly request you to assign it to me.
Thank you so much