feat(api-service): improve url handling for webhook requests#10912

Merged

scopsy merged 3 commits intonextfrom

cursor/application-security-review-a728

Apr 29, 2026

Commits on Apr 28, 2026

fix(worker,providers): validate outbound URLs against SSRF

cursoragent
and
scopsy
committed
fix(worker): normalize scheme-less reply and chat webhook URLs before SSRF

cursoragent
and
scopsy
committed
fix(shared): broaden IPv6 private range checks in SSRF validation

cursoragent
and
scopsy
committed