Network egress disclosure

This file is generated from the repository-root egress.yaml, the single source of truth for vendor-bound egress. tokenhush privacy renders the same data, and tokenhush privacy --json emits it as JSON. Do not edit this file by hand; edit egress.yaml and regenerate.

Tokenhush can make exactly two vendor-bound requests. Both are command-scoped, meaning they run only when the corresponding command runs, and both are switchable.

Category	Switch (set to 1 to disable)	Host	Retention
update-check	TOKENHUSH_NO_UPDATE_CHECK	updates.tokenhush.com	Vendor access logs and request records are retained for 30 days.
rule-sync	TOKENHUSH_NO_RULE_SYNC	updates.tokenhush.com	Vendor access logs and request records are retained for 30 days.

These are the only vendor-bound requests Tokenhush itself can make; both are command-scoped and switchable, and beyond them the only traffic leaving the machine is the user’s own requests to their provider.