Security model

SSRF resistance without false promises.

A public link-preview endpoint turns user input into outbound network traffic. linkpeek narrows that risk, but the runtime and deployment network remain part of the security boundary.

What is blocked by default

• Non-HTTP(S) protocols and URLs with embedded credentials
• localhost and literal private, link-local, multicast, documentation, and other non-global IP ranges
• IPv4 embedded through mapped IPv6, NAT64, and 6to4 forms
• Common credential-bearing custom request headers
• Extracted media, canonical, and oEmbed URLs outside HTTP(S)

Redirects are validated before the next fetch

Platform fetch runs with redirect: "manual". Each Location target is resolved and validated before another request starts. Custom headers are dropped when a redirect crosses origins.

Never make ambient authority portable

Do not attach user cookies, authorization headers, cloud tokens, or internal service credentials to arbitrary preview URLs. linkpeek rejects common secret-bearing headers, but deployments should also keep the preview worker isolated from internal credentials.

The honest DNS boundary

For hostile public input, add outbound firewall or platform egress policy so the worker cannot reach metadata services or internal networks even if DNS changes between validation and connection.

Production checklist

1. Keep allowPrivateIPs false.
2. Rate-limit public endpoints and cap concurrency.
3. Cache successful results; do not cache target errors.
4. Render all returned strings and URLs as untrusted input.
5. Require custom fetch implementations to honor manual redirects and abort signals.
6. Use network-level egress policy for high-risk deployments.