Webhook Relay

Challenge Question

A 'register your webhook' feature lets users supply a URL that the server will call when something happens. It checks the target against an allowlist first, then fetches it on your behalf. Allowlist checks and the actual fetch don't always agree about where a URL really points. Make the server call an internal admin route it should never reach. This is a live challenge with its own instance.