diff --git a/scripts/generate-caddyfile.sh b/scripts/generate-caddyfile.sh
index b062488..50ac29b 100755
--- a/scripts/generate-caddyfile.sh
+++ b/scripts/generate-caddyfile.sh
@@ -234,27 +234,22 @@ with open(caddy_file, "a", encoding="utf-8") as f:
                 for method in rule["methods"]:
                     allowed_by_method.setdefault(method, []).append(rule["ip_cidr"])
 
-            for method in WRITE_METHODS:
-                matcher = f"blocked_{safe_name}_{method.lower()}"
+            for method in ALL_METHODS:
                 allowed_ips = sorted(set(allowed_by_method.get(method, [])))
 
+                # Core rule:
+                # If a method has no rules, it stays open.
+                # If a method has at least one rule, it becomes IP-whitelisted.
+                if not allowed_ips:
+                    continue
+
+                matcher = f"blocked_{safe_name}_{method.lower()}"
+
                 f.write(f"    @{matcher} {{\n")
                 f.write(f"        path /apps/{app_id}/*\n")
                 f.write(f"        method {method}\n")
                 f.write("        not path " + " ".join(open_paths) + "\n")
-                if allowed_ips:
-                    f.write("        not remote_ip " + " ".join(allowed_ips) + "\n")
-                f.write("    }\n")
-                f.write(f"    respond @{matcher} \"Forbidden\" 403\n\n")
-
-            get_allowed_ips = sorted(set(allowed_by_method.get("GET", [])))
-            if get_allowed_ips:
-                matcher = f"blocked_{safe_name}_get"
-                f.write(f"    @{matcher} {{\n")
-                f.write(f"        path /apps/{app_id}/*\n")
-                f.write("        method GET\n")
-                f.write("        not path " + " ".join(open_paths) + "\n")
-                f.write("        not remote_ip " + " ".join(get_allowed_ips) + "\n")
+                f.write("        not remote_ip " + " ".join(allowed_ips) + "\n")
                 f.write("    }\n")
                 f.write(f"    respond @{matcher} \"Forbidden\" 403\n\n")