"SpiderTools.scrape_page()" validates the initial URL and rejects direct loopback, private, link-local, metadata, and internal hostnames. It then calls "requests.Session.get()" without disabling automatic redirects or validating redirect "Location" targets. Requests follows redirects by default for GET requests. A safe-looking public URL can therefore pass "_validate_url()", redirect to a blocked target such as "127.0.0.1" or "169.254.169.254", and have the redirected response body parsed and returned by "scrape_page()". The same sink is used by "extract_links()", "crawl()", and "extract_text()" through their calls to "scrape_page()".