A web fetcher that assumes the worst
DNS is resolved before connecting, and private, loopback, and cloud-metadata addresses are refused. The live connection is re-checked to defeat DNS rebinding. Content types are allowlisted, and per-host pacing is shared across processes.