Add 'diff' to verboten commands in CLI API