The engine prevents SSRF vulnerabilities by validating every target host against non-public and cloud-metadata IP addresses before connecting, re-checking safety on every redirect hop, and issuing a ranged streaming GET request that reads only status headers.
flowchart TD
A[URL Input] --> B[Validation Layer<br/>Scheme check & DNS getaddrinfo]
B --> C{IP Filter<br/>Private/Loopback/Metadata?}
C -->|Yes: Forbidden IP| D[Reject & Abort]
C -->|No: Public IP| E[safe_get Execution<br/>Range: bytes=0-0 & no redirects]
E --> F{Response Check}
F -->|3xx Redirect| G[Extract Location URL]
G --> B
F -->|2xx/4xx/5xx| H[Read Status Code]
H --> I[Close Socket Stream]