# Server-Side Request Forgery (SSRF) Protection

**Document Version:** 1.0.0 (Phase 21)

---

## 1. Network Boundary Defenses

The `SsrfProtectionService` intercepts external URLs and prevents requests to:
- Loopback addresses (`127.0.0.0/8`, `::1`, `localhost`)
- Private subnets (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`)
- Cloud instance metadata services (`169.254.169.254`, `metadata.google.internal`)
- Non-HTTP(S) protocols (`file://`, `ftp://`, `gopher://`)