You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
SSRF DNS rebinding fix — safe_fetch now patches socket.getaddrinfo for the entire duration of each HTTP request so a DNS rebinding attack cannot swap a public IP (returned during validation) for a private one during the actual connection. DNS lookup failures now also raise an error instead of silently skipping the IP check.
yt-dlp SSRF bypass fix — download_audio now runs validate_url before handing the URL to yt-dlp, blocking private IPs and disallowed schemes on the video/audio ingest path.
