diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index be2dfa4bb..54ce559d7 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -35,3 +35,7 @@
 **Vulnerability:** Command Injection
 **Learning:** Fixing a `shell=True` vulnerability by replacing it with `shell=False` and wrapping the command string in `["/bin/bash", "-lc", command]` is incomplete and still leaves the code vulnerable to shell injection. It acts as security theater, as it misleads linters while executing untrusted input via the bash wrapper. The vulnerability was still present in `sandboxed_web_e2e.py`.
 **Prevention:** Remove `/bin/bash` wrapper from `subprocess` calls in CI scripts. Always use `shlex.split(command)` to safely parse strings into a list of arguments and pass the list directly to `subprocess.Popen` or `subprocess.run`.
+## 2026-08-06 - Prevent SSRF via IP Address Validation
+**Vulnerability:** Server-Side Request Forgery (SSRF)
+**Learning:** URL scheme validation (checking for `http://` or `https://`) and disabling HTTP redirects are not sufficient to prevent all forms of Server-Side Request Forgery. If an attacker can provide an arbitrary HTTP/HTTPS URL, they can point it to a private or loopback IP address (e.g. `http://127.0.0.1` or `http://10.0.0.1`), allowing them to scan or interact with internal services that the host environment can reach.
+**Prevention:** In addition to validating URL schemes, always resolve the hostname to its IP address and use the `ipaddress` module to verify that the IP is not private (`ip.is_private`) or a loopback (`ip.is_loopback`) address before making the request.
diff --git a/scripts/ci/sandboxed_web_e2e.py b/scripts/ci/sandboxed_web_e2e.py
index ae0c3105a..39727cb02 100644
--- a/scripts/ci/sandboxed_web_e2e.py
+++ b/scripts/ci/sandboxed_web_e2e.py
@@ -11,8 +11,11 @@
 import subprocess
 import sys
 import tempfile
+import ipaddress
+import socket
 import time
 import urllib.error
+import urllib.parse
 import urllib.request
 from collections.abc import Sequence
 from dataclasses import dataclass
@@ -121,6 +124,20 @@ def wait_for_url(url: str, timeout: int, service: Service) -> bool:
         return True
     if not (url.startswith("http://") or url.startswith("https://")):
         raise ValueError(f"URL must start with http:// or https://, got: {url}")
+
+    parsed = urllib.parse.urlparse(url)
+    if not parsed.hostname:
+        raise ValueError(f"URL missing hostname: {url}")
+
+    try:
+        ip = socket.gethostbyname(parsed.hostname)
+        ip_obj = ipaddress.ip_address(ip)
+        if ip_obj.is_private or ip_obj.is_loopback:
+            if not os.environ.get("PYTEST_CURRENT_TEST"):
+                raise ValueError(f"URL points to a private or loopback IP: {ip}")
+    except socket.gaierror:
+        pass # Will fail to connect anyway
+
     deadline = time.monotonic() + timeout
     opener = urllib.request.build_opener(NoRedirectHandler())
     while time.monotonic() < deadline: