Whitelist soulterminal.ai (false positive)

[Bojangly]

Summary

Adds soulterminal.ai and its controlled subdomains to whitelist.yaml following a Phantom-specific false-positive warning.

Why this is a false positive

Phantom currently redirects visits to soulterminal.ai to its malicious-site warning. The domain is not present in the repository's current blocklist.yaml, and the warning has not been reproduced in the other browsers and crypto wallet applications tested.

Soul Terminal is a public Solana token-discovery and market-information interface. Its current public login surface does not offer wallet connections or wallet-based authentication; authentication is handled through Telegram.

Public verification resources:

• Site: https://soulterminal.ai/
• Trust and authentication disclosure: https://soulterminal.ai/trust
• Security contact and policy metadata: https://soulterminal.ai/.well-known/security.txt
• Security contact: security@soulsystems.tech

The homepage intentionally uses a Cloudflare Managed Challenge. The /trust and /.well-known/security.txt resources are public and return HTTP 200 without requiring authentication or a wallet connection.

I understand the repository README says whitelist.yaml is not currently consumed by the production extension. In addition to the allowlist entry, please treat this PR as a request to review and remove the heuristic or internal reputation flag causing Phantom's warning.

Validation

• node ./ci.js
• yarn build
• Parsed whitelist.yaml and verified both new entries are present

Summary by CodeRabbit

• New Features
  • Added support for accessing soulterminal.ai and its subdomains.
• Bug Fixes
  • Preserved access to nftplus.io.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ee118373-83d6-43a3-8bab-e0779629b538

📥 Commits

Reviewing files that changed from the base of the PR and between 5030186 and 9126023.

📒 Files selected for processing (1)

• whitelist.yaml

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📝 Walkthrough

Walkthrough

The whitelist now includes soulterminal.ai and all subdomains through *.soulterminal.ai. The existing nftplus.io entry remains unchanged.

Changes

Whitelist domain update

Layer / File(s)	Summary
Add soulterminal.ai entries whitelist.yaml	The whitelist adds soulterminal.ai and *.soulterminal.ai. The nftplus.io entry remains present.

Merge Risk: 🔵 Low · up to 91260

This change adds soulterminal.ai and a wildcard entry covering its subdomains to the allowlist. If enforced downstream, that could extend trusted scope to any matching subdomain, while the repository does not define the matching boundary or establish control of the full namespace. The PR is mergeable with explicit owner awareness or follow-up to confirm those controls or limit the entries to verified hosts.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding soulterminal.ai to the whitelist due to a false-positive warning.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[Bojangly]

@MarbleGarden Could you please help review this false positive, similar to your investigation in #1797?

soulterminal.ai is not present in the current blocklist.yaml, but Phantom still redirects it to the red malicious-site warning. The warning has not been reproduced in the other browsers and crypto wallet applications tested. The released verification resources are https://soulterminal.ai/trust and https://soulterminal.ai/.well-known/security.txt.

Because the repository notes that whitelist.yaml is not currently production-enforced, we would appreciate investigation and removal of the underlying Phantom reputation or heuristic flag.