Execution safety, control 4 of 9
S-04 Constrain network destinations and file access
P0Hard gateNeeds your evidence
URL fetching and file operations must not become a route to internal services, private networks or paths outside the approved workspace.
- Priority
- Gate. A FAIL stops publish or launch.
- Hard gate
- Yes. A FAIL stops publication, whatever the score.
- Change class
- READ_ONLY: Inspect authorised evidence.
- Quality bucket
- Not scored: hard gate only
Evidence to review
- Network/file policy and adversarial tests covering redirects, DNS changes and path escapes.
How to implement
- Validate schemes, destinations, resolved addresses, redirects and connection-time targets.
- Block unauthorised loopback, link-local, private and metadata-service access.
- Constrain downloads, content size and decompression.
- Recheck destinations on redirects/retries and prevent path traversal.
How UltimateSEO checks this
Needs your evidence. No automated check covers this control, so it stays UNKNOWN until evidence is supplied.
States used: PASS, FAIL, UNKNOWN, NOT_APPLICABLE or BLOCKED. UNKNOWN is never shown as a pass. How states work.
Part of The UltimateSEO Framework v4.3, catalogue dated 2026-10-14. Evidence states, control states and the publish gate are explained on the hub.