article
An SSRF wrapper that says it pins DNS, then lets fetch look the name up again
The outbound-request guard I committed during a monorepo move checks one DNS answer and connects with another, has no callers, and has no tests. Reading the diff turned up rebinding, IPv6, redirect and timeout gaps, plus a webhook path with its own weaker check.
Read more