spacexploration.com

This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.

The tool has the server fetch an arbitrary attacker/user-supplied https URL. Although it states only 'publicly routable' hosts are accepted, this kind of server-side fetch is a classic SSRF vector (e.g. DNS rebinding, redirects to internal/link-local addresses, cloud metadata endpoints) if the host-validation is not robust. Worth confirming the validation happens at request time (not just DNS resolution before redirect) and that redirects are not followed to private ranges.