Function isLoopbackHost

apps/sim/connectors/s3/s3.ts:132–135

* Returns true when the host is a loopback address for which plain `http://` is * tolerated (local MinIO development on a self-hosted deployment). Any other * host must use `https://`. This is only an early check — the SSRF boundary is * enforced at request time by secureFetchWithRetry, w

(host: string)

 * loopback/private targets on hosted Sim regardless of what this parser accepts.
 */
function isLoopbackHost(host: string): boolean {
  const bare = host.replace(/^\[|\]$/g, '')
  return bare === 'localhost' || bare === '127.0.0.1' || bare === '::1'
}

/**
 * Parses and validates a custom S3-compatible endpoint string.