# Network and SSRF security

* Use HTTPS and never disable certificate or TLS validation.
* Restrict inbound and outbound access to required ports, interfaces, hosts, and protocols.
* Treat user-controlled URLs as dangerous. Allowlist schemes and destinations, reject loopback, link-local, private, and cloud metadata ranges unless explicitly needed, and validate the resolved destination.
* Revalidate every redirect and DNS resolution to prevent redirects, rebinding, or mixed-address answers from bypassing destination restrictions. Disable automatic redirects when they cannot be safely checked.
* Set connection and overall timeouts, response-size limits, bounded concurrency, bounded retries, and cancellation for remote operations.
* Avoid forwarding ambient credentials, cookies, or authorization headers to a new host or redirect target.
* Use controlled egress where possible and avoid exposing internal error details or response bodies from remote services.