link.unsafe_redirect_target
A hop in the chain redirected somewhere the walker refused to follow.
What it looks at#
The redirect-chain walker refuses to follow a hop if it redirects to a non-HTTP(S) scheme,
or to a host that isn’t publicly routable — private and reserved IP ranges, loopback,
link-local addresses, and similar. When that happens mid-chain, the walk stops, records
which URL and which reason (data.chain.blocked.reason: "scheme" or "host") caused the
refusal, and this finding fires instead of silently reporting whatever partial chain it had.
This is a per-hop check, not a fully pinned connection across the whole chain — the walker re-resolves and re-validates on each hop, which is a real mitigation against a redirect chain that tries to send it somewhere unsafe, but it does not fully close DNS rebinding (a resolver that changes its answer between this check’s lookup and a later real request). That limitation is inherent to any runtime that resolves-and-connects inside one opaque HTTP call, not specific to this implementation.
Why it matters#
A URL engineered to redirect into a private network is very often an SSRF attempt — using the screening service itself as a proxy to probe internal infrastructure. This finding is as much about protecting the systems running this check as it is about protecting your own users from a malicious destination.
What to do#
High severity blocks by default. There’s no legitimate reason a public-facing link should redirect to a non-routable target.