Reviews the code that makes your server fetch a URL before you merge - webhooks, link previews, avatar and image fetchers, import-from-URL, PDF renderers and AI agent fetch tools: can someone outside point it at the cloud metadata service, localhost, a private network or a cluster service, and what comes back. Catches URLs fetched as given, checks on the string instead of the resolved address, alternative IP spellings, DNS rebinding, redirects followed without a re-check, open schemes such as file and gopher, and raw responses returned to the caller, then gives the smallest code that closes each path and the requests to test it with.