whitelist: add halowave.io + *.halowave.io (HaLoWave DePIN — false positive)

[HaLoWaveNetwork]

Summary

console.halowave.io (HaLoWave Provider Console) is being blocked in Phantom mobile with the full-screen warning "halowave.io is blocked!" — a false positive.

HaLoWave is a legitimate Solana-based DePIN network for Wi-Fi HaLow wireless infrastructure. The console is the official operator dashboard for miner/relay device owners.

Why this is a false positive

• Auth flow: wallet connect + signMessage challenge only (POST /v1/console/auth/challenge → sign → verify). No seed phrase prompts, no token approvals, no drainer-style transactions on login.
• Public properties: https://halowave.io, https://console.halowave.io, https://explorer.halowave.io, https://api.halowave.io
• Not on public blocklist: We checked blocklist.yaml on master — no halowave entries found. This PR adds a preventive whitelist entry per README guidance for legitimate subdomains.

Domains to allow

• halowave.io
• *.halowave.io (console, explorer, api, portal, admin)

Verification

• Website: https://halowave.io
• GitHub: https://github.com/HaLoWaveNetwork
• X: https://x.com/HaLoWaveNetwork
• Discord: https://discord.gg/gNn3tShRsA
• Email sent to review@phantom.com + review@blowfish.xyz on 2026-08-19

Happy to provide DNS TXT proof-of-control or signed wallet message if needed.

Summary by CodeRabbit

• New Features
  • Added halowave.io and its subdomains to the approved domain whitelist.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b5746c3d-e2f4-492c-a2a5-73351f02723d

📥 Commits

Reviewing files that changed from the base of the PR and between 5030186 and 8890482.

📒 Files selected for processing (1)

• whitelist.yaml

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📝 Walkthrough

Walkthrough

The whitelist now includes halowave.io and *.halowave.io. The existing nftplus.io entry remains unchanged.

Changes

Whitelist update

Layer / File(s)	Summary
Add HaloWave domains whitelist.yaml	The whitelist adds halowave.io and *.halowave.io while retaining nftplus.io.

Merge Risk: 🔵 Low · up to 88904

This change adds a wildcard exception for the entire halowave.io namespace, which could allow future or compromised subdomains to bypass blocking if downstream clients honor it. The PR is mergeable with explicit owner awareness that the exact scope and revocation behavior should be confirmed.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the whitelist additions and the false-positive context.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}