Find SSRF sinks where the URL is user-shaped

List every outbound request builder and check where the URL, host, or path comes from. Validation before the fetch is often bypassable by redirects and rebinding.

grep -rEn "requests.get|urlopen|HttpClient|OkHttp|axios|fetch(|http.Get|Net::HTTP" --include=*.{py,java,js,ts,go,rb} .

The bug is a URL taken from input.

requests.get(request.GET["callback_url"])   # internal ranges, metadata

Pro note: a hostname allow-list checked before the request does not survive redirects, so require the client to disable redirects or re-validate each hop. Flag image, webhook, PDF, and link-preview features specifically; they are the SSRF factories.