From 9d467b943491042654f63d6c134ef9a18e1080f9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=90=D0=BB=D0=B5=D0=BA=D1=81=D0=B0=D0=BD=D0=B4=D1=80=20?= =?UTF-8?q?=D0=93=D0=B0=D0=BB=D0=BA=D0=B8=D0=BD?= Date: Mon, 16 Feb 2026 22:34:36 +0300 Subject: [PATCH] docs: add SSRF protection and TLS warning sections to README Co-Authored-By: Claude Opus 4.6 --- README.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/README.md b/README.md index 0a9dacce6..d91cfb750 100644 --- a/README.md +++ b/README.md @@ -525,6 +525,32 @@ Even with `restrict_to_workspace: false`, the `exec` tool blocks these dangerous * `shutdown`, `reboot`, `poweroff` — System shutdown * Fork bomb `:(){ :|:& };:` +#### SSRF Protection (Web Fetch) + +The `web_fetch` tool blocks requests to internal and private network addresses to prevent Server-Side Request Forgery (SSRF) attacks. This protects against unauthorized access to cloud metadata endpoints (e.g. `169.254.169.254`), internal services, and local resources. + +| Blocked Range | Description | +|---------------|-------------| +| `127.0.0.0/8`, `::1` | Loopback addresses | +| `0.0.0.0` | Unspecified address | +| `169.254.0.0/16` | Link-local (cloud metadata) | +| `10.0.0.0/8` | Private network (RFC 1918) | +| `172.16.0.0/12` | Private network (RFC 1918) | +| `192.168.0.0/16` | Private network (RFC 1918) | +| `fc00::/7` | IPv6 unique local addresses | + +Hostnames are resolved before checking, so DNS rebinding to internal IPs is also blocked. + +#### TLS Warning for API Providers + +When an LLM provider is configured with a plain `http://` API base URL (not `localhost` or `127.0.0.1`), PicoClaw logs a warning: + +``` +[WARN] [provider] API base uses plain HTTP — API keys may be transmitted without encryption +``` + +This helps prevent accidental credential exposure over unencrypted connections. + #### Error Examples ```