# NousResearch/hermes-agent · Desktop link-prefetch private-address security guard

## Open now

- 1 issue, 1 PR open on GitHub.
- #126885: \[Bug\]: Desktop link-title prefetch has no private-address guard in main and follows redirects — LAN/metadata GETs and consumed one-time links from displayed URLs
- PR #129647: fix(desktop): refuse private destinations in link titles and favicons

A reported bug and two fixes addressing the desktop client's link-title (and favicon) prefetch making unguarded requests to private/LAN addresses, metadata endpoints, and one-time-use URLs. The fixes add destination filtering to refuse private and token-bearing targets.

## TL;DR

- 3 member(s): 1 open issue(s), 0 closed issue(s), 1 open PR(s), 0 merged PR(s), 1 PR(s) closed without merging.
- No fix has been merged to main; one or more PRs were attempted (see below).
- **Recommended:** review the prior/competing PR(s) below. A fix was attempted but not merged; your case may extend or revive that work.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `unresolved`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_SPANNING`): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
- Pairwise link density `1.00`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Open related issues

- #126885: \[Bug\]: Desktop link-title prefetch has no private-address guard in main and follows redirects — LAN/metadata GETs and consumed one-time links from displayed URLs

## Prior & competing PRs

- **#126912: fix(desktop): refuse private and token destinations in the link-title prefetch**. closed without merge
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `#129647`
- **#129647: fix(desktop): refuse private destinations in link titles and favicons**. open
  - maintainer direction: category `partial_fix`; implication `needs_llm`; refs `2d77525cf59002b97776a8abcdcfb35884baae27`, `51ebcc0f8deb8fc58644b3a53bfe8533520761ac`, `29f5d54813`
  - files: `apps/desktop/electron/favicon.test.ts`, `apps/desktop/electron/favicon.ts`, `apps/desktop/electron/link-metadata-fetch.test.ts`, `apps/desktop/electron/link-metadata.ts`, `apps/desktop/electron/link-title-curl.test.ts`, `apps/desktop/electron/link-title-curl.ts`, `apps/desktop/electron/link-title-guard.test.ts`, `apps/desktop/electron/link-title-guard.ts`, `apps/desktop/electron/link-title-wall.test.ts`, `apps/desktop/electron/link-title-wall.ts`, `apps/desktop/electron/metadata-http-hop.ts`, `apps/desktop/electron/safe-http-redirects.ts`

## Fix status

- No merged fix on record.
- Subsystem: `apps/desktop`