diff --git a/shared/rules/security/references/network.md b/shared/rules/security/references/network.md
index d478c34..3d63da0 100644
--- a/shared/rules/security/references/network.md
+++ b/shared/rules/security/references/network.md
@@ -2,5 +2,8 @@
 
 * Use HTTPS and never disable certificate or TLS validation.
 * Restrict inbound and outbound access to required ports, interfaces, hosts, and protocols.
-* Treat user-controlled URLs as dangerous: allowlist schemes and hosts, block localhost, metadata, and internal ranges, and revalidate redirects.
-* Set timeouts, response-size limits, bounded retries, and cancellation for remote operations.
+* Treat user-controlled URLs as dangerous. Allowlist schemes and destinations, reject loopback, link-local, private, and cloud metadata ranges unless explicitly needed, and validate the resolved destination.
+* Revalidate every redirect and DNS resolution to prevent redirects, rebinding, or mixed-address answers from bypassing destination restrictions. Disable automatic redirects when they cannot be safely checked.
+* Set connection and overall timeouts, response-size limits, bounded concurrency, bounded retries, and cancellation for remote operations.
+* Avoid forwarding ambient credentials, cookies, or authorization headers to a new host or redirect target.
+* Use controlled egress where possible and avoid exposing internal error details or response bodies from remote services.