Users with station WebHooks permission can bypass the `UserUrlFilter` SSRF guard using HTTP redirects. By configuring webhooks for Mastodon, Telegram, GroupMe, or RadioReg to point to a redirecting URL, the Guzzle client can be forced to access internal services and expose the responses through test logs. Server-Side Request Forgery (SSRF) is a flaw where an attacker induces a server-side application to make requests to an unintended location.