Opening a URL built from user input allows server-side request forgery to internal services.
Validate the URL against an allowlist of hosts and schemes before fetching.