Your Localhost Is Not Private: Securing Developer Environments Against Localhost SSRF and DNS Rebinding

Most developers treat localhost as a trust boundary. Anything bound to 127.0.0.1 is assumed to be reachable only by you. That assumption has failed repeatedly, in browsers, AI tooling, dev servers and