Blocks are meant to stop quiet exfil and foot-guns - not to make the open web unusable under Safe desktop.
Tokens in query strings, password-like userinfo, and known key prefixes often mean an agent (or a paste) is about to send credentials outbound. DenyOut denies and redacts what it shows you.
Lab and product canaries prove the seatbelt still fires. A canary hit is always deny - treat it as a drill that worked.
Metadata IPs, link-local, and other SSRF-shaped targets are denied so tools cannot probe the machine's neighborhood through the proxy.
Optional phishing and malware domain feeds can deny after a good fetch. Failures keep the last good cache. Protect still runs. Stronger and broad ad lists stay off unless you opt in.
Under My agents, unknown hosts deny or Ask. That is the point of a seatbelt for tools that read untrusted text and still have network.