Three weeks ago, in the comments under a post about a different SSRF bug (CVE-2026-19304, a parser-confusion issue), someone asked a sharp question about our own URL-fetching endpoints. I answered honestly that we'd only tested that our hostname-validation and the actual fetch agreed on parsing the same string — and that whether a validated hostname could resolve to something different by the time we actually connected was a real gap we hadn't checked. I said I'd go find out whether Cloudflare W...