The link probe enforces SSRF protection through a safe_get wrapper that validates target hosts against restricted IP ranges and cloud metadata endpoints while performing per-hop redirect re-validation.
flowchart LR
A[Target URL] --> B[DNS Resolution]
B --> C{Public IP?}
C -- No: Private/Loopback/Metadata --> D[Block Request]
C -- Yes: Public IP --> E[Fetch Header Range 0-0]
E --> F{Redirect 30x?}
F -- Yes --> G[Extract Location Header]
G --> B
F -- No --> H[Return Status Code]