Security Reference

Security invariants for Cherry Studio's main process, which handles renderer-, assistant-, and provider-controlled input. Currently covers the rules for fetching untrusted URLs.

Document	Purpose
Remote Fetch Safety	SSRF-safe rules for main-process fetches of untrusted URLs — DNS pinning, private-address and redirect rejection