Each unique HTTP(S) URL is validated through an SSRF-safe wrapper using a fast, ranged streaming GET request that closes immediately after reading status codes, with verdicts cached for 1 hour.