: Leaking environment variables can provide the "blueprint" of a server, revealing software versions and internal credentials.
: Do not allow users to provide any arbitrary URL. If your application needs to make a callback, only allow specific, pre-approved domains and protocols (e.g., only https:// ).