{
  "scope": "Offline policy and connection-plan model; no live DNS, TLS or HTTP",
  "pythonVersion": "3.14.7",
  "urlCaseCount": 16,
  "allowedCases": 2,
  "deniedCases": 14,
  "cases": [
    {
      "case": "public IPv4",
      "allowed": true,
      "reason": "allowed connection plan",
      "plan": {
        "hostname": "receiver.example",
        "connectAddress": "8.8.8.8",
        "port": 443,
        "tlsServerName": "receiver.example",
        "certificateReference": "receiver.example",
        "certificateReferenceType": "dns",
        "httpAuthority": "receiver.example",
        "answers": [
          "8.8.8.8"
        ]
      }
    },
    {
      "case": "public dual stack",
      "allowed": true,
      "reason": "allowed connection plan",
      "plan": {
        "hostname": "dual.example",
        "connectAddress": "8.8.8.8",
        "port": 443,
        "tlsServerName": "dual.example",
        "certificateReference": "dual.example",
        "certificateReferenceType": "dns",
        "httpAuthority": "dual.example",
        "answers": [
          "8.8.8.8",
          "2606:4700:4700::1111"
        ]
      }
    },
    {
      "case": "loopback literal",
      "allowed": false,
      "reason": "address policy denied",
      "plan": null
    },
    {
      "case": "private hostname",
      "allowed": false,
      "reason": "address policy denied",
      "plan": null
    },
    {
      "case": "mixed DNS answer",
      "allowed": false,
      "reason": "address policy denied",
      "plan": null
    },
    {
      "case": "cloud metadata",
      "allowed": false,
      "reason": "address policy denied",
      "plan": null
    },
    {
      "case": "IPv6 loopback",
      "allowed": false,
      "reason": "address policy denied",
      "plan": null
    },
    {
      "case": "mapped IPv4",
      "allowed": false,
      "reason": "address policy denied",
      "plan": null
    },
    {
      "case": "documentation IPv6",
      "allowed": false,
      "reason": "address policy denied",
      "plan": null
    },
    {
      "case": "carrier NAT",
      "allowed": false,
      "reason": "address policy denied",
      "plan": null
    },
    {
      "case": "HTTP scheme",
      "allowed": false,
      "reason": "HTTPS required",
      "plan": null
    },
    {
      "case": "URL credentials",
      "allowed": false,
      "reason": "URL credentials forbidden",
      "plan": null
    },
    {
      "case": "fragment",
      "allowed": false,
      "reason": "fragment forbidden",
      "plan": null
    },
    {
      "case": "alternate port",
      "allowed": false,
      "reason": "port forbidden",
      "plan": null
    },
    {
      "case": "empty DNS",
      "allowed": false,
      "reason": "no supported address",
      "plan": null
    },
    {
      "case": "ambiguous backslash",
      "allowed": false,
      "reason": "unsupported URL characters",
      "plan": null
    }
  ],
  "dnsRebinding": {
    "validationAddress": "8.8.8.8",
    "vulnerableConnectAddress": "10.0.0.8",
    "pinnedConnectAddress": "8.8.8.8",
    "pinnedTlsServerName": "rebind.example"
  },
  "redirects": [
    {
      "location": "https://private.example/hook",
      "allowed": false,
      "plan": null
    },
    {
      "location": "https://redirect.example/hook",
      "allowed": true,
      "plan": {
        "hostname": "redirect.example",
        "connectAddress": "9.9.9.9",
        "port": 443,
        "tlsServerName": "redirect.example",
        "certificateReference": "redirect.example",
        "certificateReferenceType": "dns",
        "httpAuthority": "redirect.example",
        "answers": [
          "9.9.9.9"
        ]
      }
    }
  ],
  "ipLiteralPlans": [
    {
      "hostname": "8.8.8.8",
      "connectAddress": "8.8.8.8",
      "port": 443,
      "tlsServerName": null,
      "certificateReference": "8.8.8.8",
      "certificateReferenceType": "ip",
      "httpAuthority": "8.8.8.8",
      "answers": [
        "8.8.8.8"
      ]
    },
    {
      "hostname": "2606:4700:4700::1111",
      "connectAddress": "2606:4700:4700::1111",
      "port": 443,
      "tlsServerName": null,
      "certificateReference": "2606:4700:4700::1111",
      "certificateReferenceType": "ip",
      "httpAuthority": "[2606:4700:4700::1111]",
      "answers": [
        "2606:4700:4700::1111"
      ]
    }
  ],
  "limitations": [
    "No complete special-purpose registry implementation",
    "No network transport, TLS handshake or proxy test",
    "No redirect method, credential or retry semantics test"
  ]
}