Update: link_romance_suspicious.yml - #4964
Open
peterdj45 wants to merge 3 commits into
Open
Conversation
Enhanced detection rules for romance-related suspicious messages by adding checks for automated form submissions and explicit language in URLs.
github-actions
Bot
added
the
in-test-rules
github-actions Bot
added a commit
that referenced
this pull request
Jul 28, 2026
…al Language With Suspicious Link
Reduce FP surface on the form-submission NLU-bypass branch: - Subject filter: strings.icontains -> regex.icontains with word-boundary \bform\b (was substring-matching information/platform/transform) and submi(?:t|ssion) stem - URL-path regex: drop generic tokens (video, strip, cheating, affair, desire, intimate, explicit) that match benign CMS/webform link paths Both associated samples still match; adult-specific tokens retained. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
github-actions Bot
added a commit
that referenced
this pull request
Jul 29, 2026
…exual Language With Suspicious Link
peterdj45
changed the title
github-actions Bot
added a commit
that referenced
this pull request
Jul 29, 2026
…With Suspicious Link
The .parser != plain change surfaced FPs on Klaviyo-sent e-commerce newsletters (Boredwalk, Disturbia, Fleur du Mal): their plain links point to the sender domain while all hyperlinked CTAs route through Klaviyo trackers (klclick.com/klclick1.com), so filtering plain links leaves only off-domain trackers and the self-domain guard passes vacuously. The NLU classifier separately misfires Romance/Sexually Explicit on marketing copy. Negate when every clickable link is Klaviyo tracking AND the message passes DMARC. Uses all() (not any()) so a single injected klclick link can't bypass detection. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
github-actions Bot
added a commit
that referenced
this pull request
Jul 30, 2026
…With Suspicious Link
github-actions Bot
added a commit
that referenced
this pull request
Jul 30, 2026
…exual Language With Suspicious Link
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
adding logic to bypass NLU if the message is an automated form submission and has suspicious link terminology
adding telegraph file hosts (
telegra.ph,graph.org) to suspicious link destination listfiltering condition that requires all links to not lead to the sender's domain to exclude
.parser == plainAssociated samples