Trim redundant comments

crates/obscura-js/js/bootstrap.js

@@ -1111,10 +1111,8 @@ class Element extends Node {
         break;
     }
   }
-  // Same insertion semantics as insertAdjacentHTML but inserts a Text node
-  // instead of parsing markup — that distinction is the whole point of the API
-  // (DDoS-Guard, reCAPTCHA, and others use it precisely because it does NOT
-  // parse HTML). Position string is case-insensitive per spec. See issue #285.
+  // Like insertAdjacentHTML but inserts a Text node instead of parsing markup,
+  // so the content stays literal.
   insertAdjacentText(position, text) {
     const parent = this.parentNode;
     const node = document.createTextNode(String(text));
@@ -1133,9 +1131,8 @@ class Element extends Node {
         break;
     }
   }
-  // Per spec, returns the inserted element, or null when position is
-  // beforebegin/afterend and this element has no parent (so the node could
-  // not be placed). See issue #285.
+  // Returns the inserted element, or null for beforebegin/afterend when this
+  // element has no parent.
   insertAdjacentElement(position, element) {
     const parent = this.parentNode;
     switch (String(position).toLowerCase()) {

crates/obscura-js/src/ops.rs

@@ -509,9 +509,7 @@ fn build_request_client(proxy_url: Option<&str>) -> Result<reqwest::Client, Stri
     let mut builder = reqwest::Client::builder()
         .redirect(reqwest::redirect::Policy::none())
         .timeout(std::time::Duration::from_millis(timeout_ms))
-        // SSRF: same DNS-resolving guard as the navigation client, so a scripted
-        // fetch()/XHR cannot reach a private/loopback IP via a public hostname
-        // (env/--allow-private-network still relaxes it inside the resolver).
+        // SSRF guard: also reject hostnames that resolve to a private/loopback IP.
         .dns_resolver(std::sync::Arc::new(obscura_net::SsrfGuardResolver::new(false)))
         // Be explicit about pool size: default is unbounded which is fine,
         // but pool_idle_timeout default (90s) is short for SPA-heavy

crates/obscura-net/src/client.rs

@@ -315,9 +315,7 @@ impl ObscuraHttpClient {
                 .redirect(Policy::none())
                 .timeout(Duration::from_secs(30))
                 .danger_accept_invalid_certs(false)
-                // SSRF: resolve + validate every hostname against the deny-set
-                // so a public name pointing at a private/loopback IP is rejected
-                // at connect time (DNS-rebinding safe).
+                // SSRF guard: reject hostnames that resolve to a private/loopback IP.
                 .dns_resolver(Arc::new(SsrfGuardResolver::new(self.allow_private_network)))
 ;