How I built SSRF protection for a screenshot API

A screenshot API is "fetch any URL I give you" — a textbook SSRF target. The layered defense it actually takes: public-IP classification, guarding every request inside the browser, blocking service workers, and closing the DNS-rebinding window by checking the IP the browser really connected to.