fix(network-policy): respect SECUSCAN_ALLOW_LOOPBACK_SCANS for loopback targets

[i-OmSharma]

Description

Resolves #2047.

SECUSCAN_ALLOW_LOOPBACK_SCANS (default True) was previously honored by Safe Mode (validation.py) but ignored by Network Policy (network_policy.py), which unconditionally blocked 127.0.0.0/8 via its default denylist. This caused default Quick Start installations to fail out-of-the-box when running local scans (e.g., 127.0.0.1).

Changes Included

• Network Policy Exemption (backend/secuscan/network_policy.py): Updated denylist evaluation to skip denylist matching for loopback targets (ip.is_loopback) when settings.allow_loopback_scans is enabled.
• Targeted Security Scope: Preserved strict egress validation for webhooks in validate_egress_target() to avoid SSRF vectors.
• Unit Testing (testing/backend/unit/test_network_policy.py): Added TestLoopbackExemption test class covering:
  • 127.0.0.1 IPv4 target allowed when allow_loopback_scans=True.
  • ::1 IPv6 loopback target allowed when allow_loopback_scans=True.
  • 127.0.0.1 blocked when allow_loopback_scans=False.
  • RFC1918 / Private IP ranges (e.g., 10.0.0.1, 169.254.169.254) remain strictly blocked regardless of flag setting.
  • Updated legacy test assertions that asserted unconditional loopback blocks.
• Documentation (.env.example): Added inline commentary clarifying that SECUSCAN_ALLOW_LOOPBACK_SCANS governs both Safe Mode and Network Policy gates.

Verification

• Ran full unit test suite: 32/32 passed in test_network_policy.py.
• Ran ruff lint checks: all clean.

Fixes #2047

[Copilot]

Pull request overview

This PR fixes an inconsistency where SECUSCAN_ALLOW_LOOPBACK_SCANS was honored by Safe Mode but ignored by the Network Policy engine, causing default installs to block loopback targets like 127.0.0.1 and breaking the Quick Start workflow.

Changes:

• Updated NetworkPolicyEngine.check_access() to exempt loopback targets from denylist evaluation when settings.allow_loopback_scans is enabled.
• Added unit tests covering IPv4/IPv6 loopback allow/deny behavior under the flag, while ensuring non-loopback denylist rules remain enforced.
• Updated .env.example commentary to document the setting’s intent.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
backend/secuscan/network_policy.py	Adds a loopback exemption in denylist evaluation when allow_loopback_scans is enabled.
testing/backend/unit/test_network_policy.py	Adds loopback exemption test coverage and updates legacy assumptions about unconditional loopback blocking.
.env.example	Documents the loopback setting’s relationship to Safe Mode and Network Policy.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[i-OmSharma]

Updated the documentation in .env.example and tightened the inline commentary in network_policy.py to explicitly clarify that SECUSCAN_ALLOW_LOOPBACK_SCANS governs scan-target validation (check_access()) only, and does not alter validate_egress_target(), which continues to block loopback targets unconditionally for webhook egress.

Pushed in the latest commit!

[utksh1]

The loopback-policy fix is well-scoped, but the branch is behind main. Please rebase, preserve the test that proves only scan targets receive the loopback exception, and rerun the full suite before merge.

[utksh1]

The default loopback behavior is covered, but this implementation skips every matching denylist entry when the flag is true. An operator who explicitly adds a loopback deny policy can no longer block it. Please exempt only the default loopback rule (or give explicit operator deny rules precedence), add that regression test, then rebase on main.