The engine validates each link via an SSRF-safe wrapper that issues a single ranged HTTP request, immediately closing the connection to read the response code without downloading page bodies.

sequenceDiagram
    autonumber
    participant Engine as Outreach Engine
    participant Guard as SSRF Guard
    participant Probe as safe_get()
    participant Server as Target Server

    Engine->>Probe: safe_get(url, Range="bytes=0-0")
    Probe->>Guard: Validate resolved IP
    Note over Guard: Check metadata, private, loopback ranges
    Guard-->>Probe: IP allowed (public)
    Probe->>Server: GET url (Range: bytes=0-0)
    Server-->>Probe: HTTP status (200/206/404/etc.)
    Note over Probe: Close connection without reading body
    Probe-->>Engine: Map status to verdict (live/dead/gone/error)