Some bugs announce themselves. You're reading through a codebase and the vulnerability practically waves at you from the screen. This was not one of those bugs. This one required me to ask a question that I almost didn't ask. And that question led down a rabbit hole that ended with a server-side request forgery in a fairly popular AI SDK. The Context I've been doing security reviews of AI-related tooling lately. Partly because it's obviously where the industry is heading, and ...