{ "rules": [ { "id": "default-ai-services", "name": "default-ai-services", "policy_id": "local-policy", "scope": "global", "applies_to": "all", "resource_type": "network", "decision": "allow", "resources": [ "api.anthropic.com:443", "statsig.anthropic.com:443", "platform.claude.com:443", "mcp-proxy.anthropic.com:443", "downloads.claude.ai:443", "claude.com:443", "bridge.claudeusercontent.com:443", "**.openai.com:443", "chatgpt.com:443", "**.chatgpt.com:443", "**.oaistatic.com:443", "**.oaiusercontent.com:443", "cdn.openaimerge.com:443", "cursor.com:443", "**.cursor.sh:443", "gemini.google.com:443", "generativelanguage.googleapis.com:443", "play.googleapis.com:443", "api.perplexity.ai:443", "models.dev:443", "factory.ai:443", "**.factory.ai:443", "api.workos.com:443" ], "origin": "local", "layer": "local", "status": "active", "editable": true, "provenance": { "created_via": "default" }, "actions": [ "net:connect:tcp" ] }, { "id": "default-package-managers", "name": "default-package-managers", "policy_id": "local-policy", "scope": "global", "applies_to": "all", "resource_type": "network", "decision": "allow", "resources": [ "registry.npmjs.org:443", "npmjs.com:443", "npmjs.org:443", "npm.duckdb.org:443", "yarnpkg.com:443", "**.yarnpkg.com:443", "nodejs.org:443", "deb.nodesource.com:443", "bun.sh:443", "**.bun.sh:443", "pypi.org:443", "pypi.python.org:443", "files.pythonhosted.org:443", "pythonhosted.org:443", "pypa.io:443", "bootstrap.pypa.io:443", "astral.sh:443", "crates.io:443", "index.crates.io:443", "static.crates.io:443", "rustup.rs:443", "sh.rustup.rs:443", "static.rust-lang.org:443", "golang.org:443", "goproxy.io:443", "proxy.golang.org:443", "sum.golang.org:443", "pkg.go.dev:443", "maven.org:443", "repo.maven.apache.org:443", "gradle.org:443", "**.gradle.org:443", "spring.io:443", "java.com:443", "java.net:443", "packagist.org:443", "**.packagist.org:443", "packagist.com:443", "rubygems.org:443", "ruby-lang.org:443", "rubyonrails.org:443", "rvm.io:443", "nuget.org:443", "dot.net:443", "dotnet.microsoft.com:443", "pub.dev:443", "hex.pm:443", "cpan.org:443", "metacpan.org:443", "haskell.org:443", "swift.org:443", "cocoapods.org:443", "ziglang.org:443", "apache.org:443", "eclipse.org:443", "tuf-repo-cdn.sigstore.dev:443" ], "origin": "local", "layer": "local", "status": "active", "editable": true, "provenance": { "created_via": "default" }, "actions": [ "net:connect:tcp" ] }, { "id": "default-code-and-containers", "name": "default-code-and-containers", "policy_id": "local-policy", "scope": "global", "applies_to": "all", "resource_type": "network", "decision": "allow", "resources": [ "github.com:443", "**.github.com:443", "**.githubusercontent.com:443", "gitlab.com:443", "**.gitlab.com:443", "bitbucket.org:443", "sourceforge.net:443", "launchpad.net:443", "ppa.launchpad.net:443", "docker.io:443", "**.docker.io:443", "docker.com:443", "**.docker.com:443", "production.cloudflare.docker.com:443", "**.production.cloudflare.docker.com:443", "production.cloudfront.docker.com:443", "**.production.cloudfront.docker.com:443", "docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com:443", "dhi.io:443", "dhi.io:80", "ghcr.io:443", "gcr.io:443", "**.gcr.io:443", "mcr.microsoft.com:443", "**.data.mcr.microsoft.com:443", "quay.io:443", "registry.k8s.io:443", "k8s.io:443", "public.ecr.aws:443", "**.githubcopilot.com:443", "code.visualstudio.com:443", "vscode.dev:443", "vscode.download.prss.microsoft.com:443" ], "origin": "local", "layer": "local", "status": "active", "editable": true, "provenance": { "created_via": "default" }, "actions": [ "net:connect:tcp" ] }, { "id": "default-cloud-infrastructure", "name": "default-cloud-infrastructure", "policy_id": "local-policy", "scope": "global", "applies_to": "all", "resource_type": "network", "decision": "allow", "resources": [ "**.amazonaws.com:443", "**.googleapis.com:443", "azure.com:443", "dev.azure.com:443", "login.microsoftonline.com:443", "**.blob.core.windows.net:443", "visualstudio.com:443", "**.visualstudio.com:443", "packages.microsoft.com:443", "hashicorp.com:443", "**.hashicorp.com:443", "vercel.com:443", "**.public.blob.vercel-storage.com:443", "challenges.cloudflare.com:443", "fastly.com:443", "unpkg.com:443", "jsdelivr.net:443", "**.gvt1.com:443", "dl.google.com:443", "binaries.prisma.sh:443", "playwright.azureedge.net:443", "cdn.playwright.dev:443", "mise.run:443", "mise-versions.jdx.dev:443", "json-schema.org:443", "json.schemastore.org:443", "**.gstatic.com:443", "**.googleusercontent.com:443", "apis.google.com:443", "play.google.com:443", "www.google.com:443", "csp.withgoogle.com:443", "supabase.com:443", "clerk.com:443", "figma.com:443", "app.daytona.io:443" ], "origin": "local", "layer": "local", "status": "active", "editable": true, "provenance": { "created_via": "default" }, "actions": [ "net:connect:tcp" ] }, { "id": "default-os-packages", "name": "default-os-packages", "policy_id": "local-policy", "scope": "global", "applies_to": "all", "resource_type": "network", "decision": "allow", "resources": [ "archive.ubuntu.com:443", "archive.ubuntu.com:80", "security.ubuntu.com:443", "security.ubuntu.com:80", "ports.ubuntu.com:443", "ports.ubuntu.com:80", "ubuntu.com:443", "debian.org:443", "**.debian.org:443", "archlinux.org:443", "alpinelinux.org:443", "dl-cdn.alpinelinux.org:443", "centos.org:443", "fedoraproject.org:443", "apt.llvm.org:443", "packagecloud.io:443" ], "origin": "local", "layer": "local", "status": "active", "editable": true, "provenance": { "created_via": "default" }, "actions": [ "net:connect:tcp" ] }, { "id": "default-cert-validation", "name": "default-cert-validation", "policy_id": "local-policy", "scope": "global", "applies_to": "all", "resource_type": "network", "decision": "allow", "resources": [ "**.lencr.org:80", "**.lencr.org:443", "ocsp.digicert.com:80", "crl*.digicert.com:80", "cacerts.digicert.com:80", "*.one.digicert.com:80", "*.one.au.digicert.com:80", "*.one.ch.digicert.com:80", "*.one.nl.digicert.com:80", "*.one.digicert.co.jp:80", "ocsp.sectigo.com:80", "crl.sectigo.com:80", "crt.sectigo.com:80", "ocsp.comodoca.com:80", "crl.comodoca.com:80", "ocsp.usertrust.com:80", "crl.usertrust.com:80", "**.pki.goog:80", "**.pki.goog:443", "**.amazontrust.com:80", "**.amazontrust.com:443", "isrg.trustid.ocsp.identrust.com:80", "**.pki.microsoft.com:80", "**.pki.microsoft.com:443", "crl.globalsign.com:80", "crl.globalsign.net:80", "ocsp.globalsign.com:80", "ocsp.globalsign.com:443", "ocsp2.globalsign.com:80", "ocsp2.globalsign.com:443" ], "origin": "local", "layer": "local", "status": "active", "editable": true, "provenance": { "created_via": "default" }, "actions": [ "net:connect:tcp" ] }, { "id": "default-fs-read-allow-all", "name": "default-fs-read-allow-all", "policy_id": "local-policy", "scope": "global", "applies_to": "all", "resource_type": "filesystem:read", "decision": "allow", "resources": [ "**" ], "origin": "local", "layer": "local", "status": "active", "editable": false, "provenance": { "created_via": "default" }, "actions": [ "fs:mount:read" ] }, { "id": "default-fs-write-allow-all", "name": "default-fs-write-allow-all", "policy_id": "local-policy", "scope": "global", "applies_to": "all", "resource_type": "filesystem:write", "decision": "allow", "resources": [ "**" ], "origin": "local", "layer": "local", "status": "active", "editable": false, "provenance": { "created_via": "default" }, "actions": [ "fs:mount:read", "fs:mount:write" ] } ] }