Addresses blocked even when allowPrivateIp is on. Cloud metadata services
(AWS/GCP/Azure IMDS) live at 169.254.169.254 and would exfiltrate
credentials if a CI runner or long-lived server followed an attacker URL to
them. IPv6 link-local (fe80::/10) is the v6 equivalent reach into the
host's local segment.
Addresses blocked even when
allowPrivateIpis on. Cloud metadata services (AWS/GCP/Azure IMDS) live at 169.254.169.254 and would exfiltrate credentials if a CI runner or long-lived server followed an attacker URL to them. IPv6 link-local (fe80::/10) is the v6 equivalent reach into the host's local segment.Returns
falsefor non-IP inputs (hostnames).