Reduce false positives on legitimate HTTP clients #2

[stevehuuuu]

Optimized detection rules to reduce false positives:

1. Added allowlist patterns for legitimate HTTP client imports/usage (axios, node-fetch, got, requests, urllib3, etc.)
2. Fixed over-aggressive EXFIL_FETCH_DYNAMIC pattern to only flag dynamic fetch calls combined with sensitive data (base64, env vars, secrets)
3. Expanded SAFE_DOMAINS list to include 40+ common legitimate API/service domains (cloud providers, SaaS, package registries, AI APIs)
4. Reduced EXFIL_FETCH_DYNAMIC severity from high to medium to reduce false positive impact

• Tested thoroughly:
  • Legitimate HTTP client usage (axios, fetch, etc.) now returns 0 findings (clean)
  • Actual malicious exfiltration (secrets + base64 + fetch) is still detected as high severity
  • All existing detection capabilities for malicious code are preserved

[vercel]

Someone is attempting to deploy a commit to the Rapi's projects Team on Vercel.

A member of the Team first needs to authorize it.