- Cover host allow-list, dotted-suffix bypass, dial-time private IP - Cover no-follow redirects, streaming byte cap, and D-14 config defaults