Our SSRF guard passed every test we ran — until a stranger's comment pointed out the test we never ran

Automated excerpt

Five of our endpoints (redirect-trace, security-scan, security-headers, favicon, scrape) fetch a user-supplied URL. All five guarded against SSRF the same way: a regex blocklist checked against the hostname string before fetching. I tested this against a live rebinding domain (rbndr. us, which alternates its DNS answer between 127. 0. 0. 1 and a public IP depending on which query hits it) against our own production endpoint.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.