SSRF — fetch to user-controlled URL (A10)
Part of the AI-generated code risks check · fix arrives as a pull request
What it is
A fetch or HTTP client call targets a URL that the request controls, in whole or in part, with no allow-list of permitted destinations.
Why it matters
OWASP A10. Your server makes the request, so it makes it from inside your network — against cloud metadata endpoints, internal admin services, and anything else a firewall keeps away from the public but not from you.
How to fix it
Validate the target against an allow-list of hosts before fetching. Resolve the hostname and reject private, loopback, and link-local ranges, and disable redirect following so a public URL cannot bounce to an internal one.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.