for #3 and #4, /crx/de and /crx/explorer can be blocked at AEM itself otherwise for dispatcher you should deny all and allow only relevant paths. You should have /0001 { /type "deny" /glob "*" } to take care of "/crx" and other pathsfor #1 and #2, use "selectors" and "extension"/006 { /type "...