> For the complete documentation index, see [llms.txt](https://ciusji.gitbook.io/leona/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ciusji.gitbook.io/leona/security/the-url-whitelist.md).

# The URL Whitelist

There are certain components in leona which will perform outgoing HTTP requests. Among those, are event notifications and HTTP-based data adapters.

Allowing leona to interact with resources using arbitrary URLs may pose a security risk. HTTP requests are executed from leona servers and might therefore be able to reach more sensitive systems than an external user would have access to, including AWS EC2 metadata, which can contain keys and other secrets, Elasticsearch, and others.

<figure><img src="/files/9PVLtmcqxr0AoRrqlmd7" alt=""><figcaption></figcaption></figure>