Security

Understand the fetch boundary before deployment.

URL validation#

Linkoi rejects known local hostnames, private literal IP addresses, and unsafe redirect targets. It does not resolve DNS or pin destination addresses.

URL checks are not complete SSRF protection

A public hostname can resolve to a private address or change its answer. Use egress controls before exposing extraction to untrusted URLs on a server with access to private services.

Controlled fetching#

For a controlled network boundary, fetch HTML using your own validated transport and pass it to fromHtml with fallback: false. Supplied HTML is always parsed without network activity.

Untrusted output#

Render metadata as text. Linkoi does not sanitise arbitrary HTML or provide embed markup. Validate returned media URLs before server-side fetching; the same outbound restrictions apply.

Operate the API#

Set a bearer key, apply request limits, and choose timeouts and cache lifetimes for your application. Do not expose cache invalidation without authentication. Keep provider keys server-side.