Changed
- Hardened push-notification delivery against server-side request forgery (SSRF). Aerodrome sends notifications by POSTing to your configured ntfy URL. That URL is now checked — both when you save it and when a notification is sent — so the server won't be tricked into making requests to link-local, cloud-metadata, multicast, or reserved addresses. Your normal ntfy setups are unaffected: the bundled local ntfy (
localhost) and a self-hosted ntfy elsewhere on your network both keep working. Notification requests also no longer follow redirects, and a failed send now reports only the HTTP status code rather than echoing back the response body.