My SSRF guard blocked 127.0.0.1 and almost nothing else
Cartify fetches URLs that strangers paste in. Here is every hole my first SSRF guard missed, from bracketed IPv6 to redirects, and how each one got closed.
Read the articleBuilt in public
Articles
Notes from building Craftory in the open: how each app works, what broke, what it cost, and what comes next.