feat(config): validate clients and scope security

2026-09-14 01:07:46 +02:00
parent 5b0c623a8d
commit a3cee2756c
17 changed files with 230 additions and 437 deletions
@@ -0,0 +1,6 @@
+# Network and SSRF security
+
+* Use HTTPS and never disable certificate or TLS validation.
+* Restrict inbound and outbound access to required ports, interfaces, hosts, and protocols.
+* Treat user-controlled URLs as dangerous: allowlist schemes and hosts, block localhost, metadata, and internal ranges, and revalidate redirects.
+* Set timeouts, response-size limits, bounded retries, and cancellation for remote operations.