Threat model

Risk	Real?	Priority	Treatment
Stale local list	Yes	High	Online membership query; local data only as short-lived cache
k-anonymity dictionary attack	Yes	High	Retire prefix buckets; authenticate, rate-limit and correlate anomalies
/stats leakage	Yes	Medium	Coarse, delayed service health only
Plaintext local tokens	Yes	High	Memory-only web token; OS credential facility for CLI
Filtering after WebFetch	Yes	High	PreToolUse URL check before the network request
Unknown URL redirects to a listed host	Yes	High	State the hop-visibility boundary; PostToolUse suppresses content but makes no zero-arrival claim
Plain domain hashes are dictionary-enumerable	Yes	High	No target logging by default; externally keyed HMAC for diagnostics
Ban propagation delay	Yes	Medium	Authoritative consistent state; short-TTL Bloom filter only as a fast path

A Bloom filter cannot be authoritative: false positives can deny benign users and Worker isolate memory is not globally shared.