Inspect a public link safely
Open /app/?lang=en&tool=inspect, enter a public URL such as https://example.com/article in the Public URL field and press Run. The browser sends {url,lang} as a same-origin POST to /api/v1/inspect. The server performs six stages: URL normalisation and policy validation → DNS resolution with validation of ALL addresses → connection to the pinned verified IP (original Host/SNI preserved) → full re-validation on every redirect (max 3 hops) → streaming read terminated at the 2 MiB / 10 s limits → zero-dependency static metadata extraction.
The response contains requestedUrl, finalUrl, status, title, description, canonical, openGraph, twitter, warnings and checkedAt. Query strings and fragments never appear in the response or logs. The result explicitly lists fields that were not found. All target content is rendered as inert text: fetched HTML is never injected into the front end, and no cookie or arbitrary response body is returned.
The OG image in the social card starts as a URL plus a placeholder. To preview it, click the button: the front end calls /api/v1/og-image and the backend re-applies the identical SSRF policy (including all-address DNS validation and IP pinning), accepts only image/png|jpeg|webp|gif, and returns a decoded data: URL. The browser never automatically visits an internal address induced by user input.
Limits: static HTML only; no target-page JS execution, no screenshots, no promise of matching platform caches. Timeouts, oversized/compressed responses, non-HTML content and invalid certificates all produce readable error codes, and your input is preserved on failure.