[innovativedesign-lab]

Close: #185

Here's what was done and why each decision was made:

What was built

check-broken-links.mjs
— a standalone Node.js checker (no mint CLI required) with three check categories:

Internal routes — resolves every link against the set of real .md/.mdx files, accounts for redirect sources in docs.json, and explicitly checks /assets/* paths
Heading anchors — slugifies headings the same way Mintlify does and verifies #fragment links point at real headings or id= attributes
External URLs — HEAD→GET fallback, up to 3 retries with exponential back-off + jitter, classifies each failure as PERMANENT (4xx, ENOTFOUND, ECONNREFUSED) or RETRYABLE (5xx, 429, 503, timeout); exits 1 only on permanent failures
--no-external flag — runs instantly with zero network calls, used by the PR step.

Two new npm scripts in package.json:

check:broken-links # full check (internal + external)
check:broken-links:internal # internal only (fast, offline-safe)
New broken-links job in snippets.yml:

No needs: dependency — runs in parallel with the other jobs
No continue-on-error — it's a required check that fails the PR
Internal check on every PR and push; external check only on push (keeps PR feedback fast)

[drips-wave]

@innovativedesign-lab Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[truthixify]

The new required job fails on eight internal links, so the branch does not leave the gate green. More importantly, the external checker performs unrestricted fetch(..., redirect: follow) for repository-controlled URLs without rejecting private, loopback, link-local, mapped IPv6, or redirect destinations. On the post-merge push job this is a CI SSRF path. Fix or explicitly model the eight shipped targets, resolve and pin only globally routable addresses, follow redirects manually while revalidating every hop, and add private-address/DNS-rebinding tests.

[innovativedesign-lab]

The new required job fails on eight internal links, so the branch does not leave the gate green. More importantly, the external checker performs unrestricted fetch(..., redirect: follow) for repository-controlled URLs without rejecting private, loopback, link-local, mapped IPv6, or redirect destinations. On the post-merge push job this is a CI SSRF path. Fix or explicitly model the eight shipped targets, resolve and pin only globally routable addresses, follow redirects manually while revalidating every hop, and add private-address/DNS-rebinding tests.

FIxed, kindly check

[truthixify]

The current SSRF fix is still bypassable. fetchWithTimeout uses redirect:'follow' at scripts/check-broken-links.mjs:569 until redirectCount reaches five, but redirectCount can only increment after the caller receives a manual 3xx. Native fetch therefore follows the initial redirect chain before lines 513-527 ever validate a target, so a public URL can redirect the runner to a private service. The DNS preflight is also fail-open at lines 455-458 and is not pinned to the address used by fetch. Use manual redirects on every hop, resolve relative Location values, validate every target, and eliminate the DNS-check/fetch TOCTOU (or keep external fetching out of CI). The tests currently copy a simplified helper instead of exercising the production redirect path; add an integration test proving a public-to-private redirect is blocked.