When the server fetches a URL on behalf of the user, extract only the specific data the feature requires. Return only that extracted data to the caller. Never return the raw HTTP response body.

• Link preview: parse the HTML, extract <title>, <meta name="description">, and the first image URL. Return those three fields. Do not return the raw HTML body.

• File import: parse the JSON/CSV structure. Return the count of imported records or a structured result. Do not return the raw response body in error messages.

• Webhook test: return “success” or “failed”. Do not return the HTTP response body from the webhook endpoint.

Even if SSRF occurs and the server fetches the metadata endpoint, the attacker gains nothing if the raw response is never returned. The server may process the response internally (and fail to parse it as expected data), but the credentials are never transmitted back to the caller. This doesn’t fix the SSRF vulnerability — but it prevents the exfiltration that makes SSRF dangerous.

A common SSRF exfiltration path: the URL fetch fails (wrong content type, parse error), and the error message includes the response body: “Failed to parse JSON: [raw response here].” Attacker reads the credentials from the error. Sanitize error messages — never include the raw server response in error output to the client.