[maximelb]

Email Security link inspection now refuses links whose fetch could change something on the other side (Google Calendar links, other Google or YouTube addresses outside a few reviewed view-only pages, and Amazon SNS subscription-confirmation or unsubscribe links), and links whose read-only behaviour cannot be established. This adds the new request_policy refusal code to the refusal table in detections.md, and says what it means as an address reason in a hop's blocked_ips.

It is a gap in inspection, not a finding: it adds no threat points, keeps the message marked as not fully inspected, and keeps what other links revealed.

Ships with the next Email Security collector release; merge on the day it reaches production.

StarWatch email XO via StarForge

🤖 Generated with Claude Code

[maximelb]

Pristine review record (StarWatch email Release Chief): a fresh second-opinion reviewer reviewed a git archive snapshot of this PR. Round 1 CHANGES on b7e9c98 (three wording fixes, all taken), round 2 APPROVE on 359d60a, round 3 APPROVE on the exact head 272d911 (2026-11-09, 05:11 PT). Checked against legion_mailsec a701c914 and go-mailsec v0.1.200. Merge waits for the matching Email Security release to reach production.

[limacharlie-refractionpoint]

LimaCharlie Cloud Security — code scan

No new code findings were introduced by this pull request.

This check reports and never fails: no gating.fail_on is set on the code_scanning policy.

Scanned refractionPOINT/documentation 9448b5c…272d911 — only findings new in the head commit are listed; anything already on the base branch is the repository's own finding set, on the Cloud Security Code page.

This comment is updated in place on every push to this pull request.