The request service that refuses to read the box it runs on

Internal IT hands finance a way to pull SaaS reports on a schedule. The tool is hoody-curl, and security asks the usual question: what happens when someone feeds it the wrong parameters.

Two groups of parameters are rejected with a 400 before libcurl ever sees them. The certificate fields, cacert, cert and key, take filesystem paths, so a request that named /etc/shadow as a client certificate would be probing the container's disk. The service won't accept them. The proxy fields, proxy, proxy_user and proxy_password, are refused because libcurl would reach the proxy before URL validation could inspect it. Everything else works: auth headers, retries, cookie sessions, cron schedules, responses saved to storage. Finance wraps the report pull as a GET, schedules it, holds a link.

The guardrail isn't a policy document, it's a 400.