From da134b3154cf20c23516094c3ad37a403b5c13d3 Mon Sep 17 00:00:00 2001 From: Nick Sweeting Date: Mon, 3 Aug 2026 16:15:58 -0400 Subject: [PATCH] Enhance security note on URL archiving Updated the note on URL archiving to include firewall/ACL-level blocking recommendations. --- .github/SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/SECURITY.md b/.github/SECURITY.md index 5ee6ffce..2d390022 100644 --- a/.github/SECURITY.md +++ b/.github/SECURITY.md @@ -64,5 +64,5 @@ Non-logged in users should be tightly limited to prevent attacks like SQL/shell ### SSRF / URL Validation -Note archivebox is **designed to be able to archive any URL the server can reach**, including internal intranet URLs, private IPs, and localhost. Users are expected to configure `URL_ALLOWLIST`/`URL_DENYLIST` accordingly if they need to limit what the server should archive. +Note archivebox is **designed to be able to archive any URL the server can reach**, including internal intranet URLs, private IPs, and localhost. Users are expected to configure `URL_ALLOWLIST`/`URL_DENYLIST` or proper firewall/ACL-level blocking at the network level if they need to limit what the server should see. It does a basic check to try and avoid recursively archiving snapshots hosted by the archivebox server itself, but it's not a strict security check, it's just to prevent wasted CPU/disk from recursively archiving snapshots in a browser that has the ArchiveBox Browser Extension turned on.