[codex] fix: pin safe fetch to vetted public IPs#358

Open

aa-matsunari wants to merge 1 commit intosafishamsi:v4from

aa-matsunari:codex/harden-safe-fetch

aa-matsunari commented Apr 15, 2026

Summary

pin outbound fetches to vetted public IPs instead of re-resolving during connect
revalidate redirect targets and cover the hardened path with tests

Changed files

graphify/security.py
tests/test_security.py

Impact

reduces DNS rebinding / SSRF exposure in URL ingestion flows

Tests

/tmp/graphify-review/.venv/bin/python -m pytest /tmp/graphify-review-pr3/tests/test_security.py


          [codex] fix: pin safe fetch to vetted public IPs

68dd61a

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet