Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
const response = await fetch(source.data);
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.