The SSRF guard validates every URL using manual per-hop redirect re-validation to block requests to private and cloud metadata IP ranges.

flowchart LR
    A[Target URL] --> B[assert_public_url]
    B -->|Resolves IP| C{Blocked or Private?}
    C -->|Yes| D[Raise BlockedURLError]
    C -->|No| E[Fetch 0-byte Range Stream]
    E -->|Redirect 30x| B
    E -->|Success 2xx/3xx| F[Return Response]