docs/input-ingestion-security.md

Input-ingestion security hardening

The input pipeline now applies these protections at the resolver boundary:

• URL fetching accepts only HTTP(S), rejects URL credentials and malformed ports, resolves using the scheme's correct default port, and rejects hostnames with any non-global DNS answer when private URLs are disabled.
• Redirects are handled manually, with each destination revalidated before the next request.
• HTTPX environment proxy settings are not inherited for remote media fetches, avoiding an ambient proxy changing the destination semantics.
• Remote downloads remain streamed to disk with a hard byte limit, including responses that omit or misstate Content-Length. Partial files are removed on download/validation failures.
• Client filenames are normalized across POSIX and Windows separators and reject control characters and quote characters that can corrupt response headers.

Deployment notes and remaining limits

• ALLOW_PRIVATE_URLS=true intentionally disables the private-address block; only enable it in a trusted, isolated environment.
• DNS validation and the HTTP client's subsequent connection resolution are separate operations. For hostile URL-fetching environments, production-grade SSRF protection should additionally pin the connection to a validated IP while preserving TLS hostname verification, or enforce egress restrictions at the network layer.
• Multipart parsing can spool uploads before application-level per-file limits are applied. Enforce request-body limits at the reverse proxy/ASGI boundary as well as in the resolver.
• Source-level regression tests were added but have not been run in the hosted environment. Deployment and live SSRF tests remain unverified.