Spot SSRF in URL preview features

Any feature that fetches a URL you control is a candidate for server side request forgery. The usual suspects: link previews, webhook testers, PDF and image generators, and “import from URL” fields.

POST /api/preview HTTP/1.1
Content-Type: application/json

{"url":"http://169.254.169.254/latest/meta-data/"}

Start with the cloud metadata endpoint, then try internal hostnames and alternate encodings. If the response body is hidden, watch timing and out of band DNS to confirm the fetch happened.