Security & Defense Systems
BidSaaS accepts arbitrary user URLs for metadata extraction. To guarantee stability and prevent abuse, we have implemented defense-in-depth security layers.
Comprehensive SSRF Mitigation
Every submitted URL is validated against private and loopback IPv4/IPv6 ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, and cloud metadata endpoints). Blocked before and after every redirect chain.
Fetch Boundaries & Timeouts
Enforces a strict 10-second timeout, 5MB response size limit, maximum of 5 redirects, and text/html content-type validation. Dangerous protocols (file://, gopher://, data://) are blocked.
Upstash Distributed Rate Limiting
Sensitive operations (URL inspection, bid intent creation, and searches) are guarded with sliding-window rate limiters to eliminate automated scraping and denial-of-service attempts.
Cryptographic Webhook Idempotency
Dodo Payments webhooks are verified using cryptographic signatures and tracked by unique event IDs to prevent replay attacks or duplicate bid increments.