## Lesson — Include low-level network primitives in exfil rules

**Tags:** security, node, ast-grep
**Scope:** packages/pack-agent-security/compiled-rules.json

Exfiltration detection must cover low-level APIs like `net.Socket` and `socket.connect` alongside high-level libraries to prevent simple bypasses.
