1.0.0

First release. SSRFGuard classifies whether an IP address is a safe outbound (egress) target or one that points into a private or reserved network, for IPv4 and IPv6.

Highlights:

• Strict default policy covering private, loopback, link-local, CGNAT, benchmarking, documentation, multicast, and reserved ranges for both address families.
• Unwraps IPv4-mapped, NAT64 (64:ff9b::/96), and IPv4-compatible IPv6 forms to the embedded IPv4 and re-checks them, and fails closed on malformed input.
• Configurable EgressPolicy, a typed Classification verdict, and an injectable resolver seam with a getaddrinfo-backed default that keeps a stalled lookup off the Swift concurrency pool.
• Pure Swift, no third-party runtime dependencies, on Apple platforms and Linux.

SSRFGuard is a classifier, not a defense against DNS rebinding. Resolve once, classify the exact address, and connect to that pinned address.