cat << 'EOF' | git apply
diff --git a/packages/components/src/httpSecurity.ts b/packages/components/src/httpSecurity.ts
--- a/packages/components/src/httpSecurity.ts
+++ b/packages/components/src/httpSecurity.ts
@@ -34,16 +34,45 @@
 
 /**
  * Checks if a URL is allowed based on HTTP_DENY_LIST environment variable
+ * and built-in SSRF protections (scheme and hostname/IP restrictions).
  * @param url - URL to check
- * @throws Error if URL hostname resolves to a denied IP
+ * @throws Error if URL hostname or resolved IP is denied
  */
 export async function checkDenyList(url: string): Promise<void> {
+    const urlObj = new URL(url)
+    const hostname = urlObj.hostname
+    const protocol = urlObj.protocol.toLowerCase()
+
+    // Enforce allowed protocols
+    if (protocol !== 'http:' && protocol !== 'https:') {
+        throw new Error(`Access to this URL is denied by policy: unsupported protocol "${protocol}"`)
+    }
+
+    // Block obvious local/metadata hosts regardless of HTTP_DENY_LIST
+    const loweredHost = hostname.toLowerCase()
+    const blockedHostnames = new Set<string>([
+        'localhost',
+        '127.0.0.1',
+        '::1',
+        '169.254.169.254',          // AWS/GCP metadata IP
+        'metadata.google.internal', // GCP metadata hostname
+        '169.254.169.250',
+        '169.254.170.2'             // AWS ECS task metadata
+    ])
+    if (blockedHostnames.has(loweredHost)) {
+        throw new Error('Access to this host is denied by policy.')
+    }
+
     const httpDenyListString: string | undefined = process.env.HTTP_DENY_LIST
-    if (!httpDenyListString) return
+    if (!httpDenyListString) {
+        // Even if no explicit deny list is configured, still prevent direct IP access
+        if (ipaddr.isValid(hostname)) {
+            throw new Error('Access to this host is denied by policy.')
+        }
+        return
+    }
 
     const httpDenyList = httpDenyListString.split(',').map((ip) => ip.trim())
-    const urlObj = new URL(url)
-    const hostname = urlObj.hostname
 
     if (ipaddr.isValid(hostname)) {
         isDeniedIP(hostname, httpDenyList)
EOF