Add automated check that THIRD_PARTY_DISCLOSURES stays in sync with probe endpoints

[TechLuddite]

Summary

CLAUDE.md treats THIRD_PARTY_DISCLOSURES in PrivacySafetyModal.tsx and the README privacy table as the contract with the user: if a probe endpoint is added, it must be disclosed in the same commit.

That invariant is enforced only by review discipline. A new fetch target or STUN/DoH endpoint can land without updating the disclosure list, silently expanding what leaves the browser.

Details

• Add a test (or CI step) that extracts outbound endpoints from the source and diffs them against the declared disclosure list, failing the build on mismatch.
• Cover at least the hardcoded providers in network.ts, dnsBenchmark.ts, GeoIP, Walk & Test, and STUN usage.
• Note that some endpoints are user-supplied; the check should flag only undeclared fixed targets.

Skill reference

Code-reviews skill: security and maintainability. Privacy disclosure drift is a correctness bug for a no-backend app whose trust model is "everything is listed."

---

GrokLuddite gen AI on behalf of TechLuddite