Provides IP and CIDR parsing utilities including IPv4-mapped/IPv6-embedded address detection, BlockList helpers, and a DeniedAddressSet for guarding against loopback, link-local, cloud metadata, and user-configured address ranges. This module is self-contained, relies only on Node.js built-ins, and can be extracted for any network security tool requiring address validation or DNS rebinding protection.

Implements a streaming transform that replaces sentinel placeholder strings with real values in HTTP request bodies, with length-matched and non-length-matched modes. It uses bounded memory, handle split sentinel boundaries across chunks, and fails safely if a sentinel is split across chunk boundaries. This is a general-purpose pattern for secret masking in streaming data pipelines, decoupled from any specific credential format.

Provides host pattern matching supporting wildcards (`*` for subdomain matching), port suffixes, IPv6 bracket normalization, and canonicalization (including inet_aton, trailing dot removal). Used for network allow/deny lists. The module is small, has no internal dependencies on other sandbox modules, and is directly reusable in any proxy, firewall, or access control application.

A minimal shell-quoting utility that wraps arguments in POSIX-safe quotes to prevent shell injection, replacing the npm `shell-quote` package with a correct implementation that handles the `!` character (history expansion) properly. This is a drop-in replacement for a common npm package, demonstrating practical craftsmanship in fixing a known bug without external dependencies.