Security audit: SSRF attack surface analysis#213

Merged

RafaelPo merged 7 commits into

mainfrom

Feb 25, 2026

Commits on Feb 25, 2026

Add comprehensive SSRF security audit report

RafaelPo
and
claude
committed
Fix SSRF: pin resolved IPs to close TOCTOU, add port allowlist

RafaelPo
and
claude
committed
Remove dead _validate_hostname wrapper

RafaelPo
and
claude
committed
Remove SSRF audit report from PR

RafaelPo
and
claude
committed
Fix IPv6 Host header construction, add IPv6 test coverage, remove finding refs

RafaelPo
and
claude
committed
Use IDNA codec for SNI hostname encoding

RafaelPo
and
claude
committed
Make DNS resolution non-blocking for multi-user concurrency

RafaelPo
and
claude
committed