Didn’t know this:

Shallow clones are awful. Run your own damn mirror if you’re going to do something nasty like that.

Shallow is the default/recommended in a lot of places though apparently:

Shallow wins the clone, every time, by 4-6x. Which is exactly why actions/checkout defaults to depth=1, why GitLab CI ships GIT_DEPTH=20, and why Vercel hard-codes --depth=2 with no way to change it.

https://bex.co/blog/2026/08/08/git-push-paas-shallow-vs-partial-clone-build-checkout

Separately, one source of the scraping:

welcome to the wonderful world of “proxy SDK monetization.” It’s big business, and your TV is probably doing it.

The link in the article is useful, https://spur.us/blog/smart-tv-apps-residential-proxy-sdks

Amazon makes it explicit: its Device and System Abuse Policy prohibits apps that facilitate proxy services for third parties. Roku has reportedly shut the door too: Lowpass, syndicated at The Verge, reported that Roku bars developers from using Bright SDK and similar proxy services, and that Roku apps using the SDK disappeared after the company was contacted.

LG and Samsung have not drawn an equivalent public line. That is the gap these apps are living in. The same business model that Amazon bans and Roku reportedly blocks is still showing up at scale on webOS and Tizen.

It concludes:

A TV app should not be able to quietly turn a living-room device into residential proxy infrastructure. Screensavers, games, clocks, and novelty apps can be boring, cheap, or ad-supported. If an app is going to monetize a household’s internet connection, the user should be clearly informed about what that means, how the connection will be used, and what risks and tradeoffs they are accepting.

We need to help everyone in the world block their TVs from doing this, this is such an abuse of trust.