┌────────┐
│ \\  // │
│--(OO)--│
│ //  \\ │

⨰REFUSEDsink_gate

layer 1 — structural, before any request left the process

step3 fetch url = {{target}}

valuehttps://blog.attacker.test/collect?d=notes

originextract read off the page — tainted

contractdefault-deny

reasontainted value in sensitive sink arg(s) ['url']

The extractor read this address off the page it had just crawled. The plan fixed every destination before that page was fetched — so the value can be carried as content, but it can never become a destination.

auditruns/96bfa657/audit.jsonl · verdict deny