SSRF
Tricking a server into making requests to addresses it should not reach.
What it means
If a service will fetch any URL a user gives it, an attacker can point it at internal addresses such as a cloud metadata service or a private network. Defences check the address, not just the name, and do so at connect time.
How Onekey handles it
A webhook URL must be https on port 443 to a public host, with no user info, no numeric or internal names and no private, loopback, link-local or metadata address in any DNS answer. The host is resolved again at delivery and the connection goes to that exact address, so a DNS change between check and connect cannot redirect it. Redirects are never followed. A rejected URL is WEBHOOK_URL_REJECTED.