[False Positive]: TG-SSRF-001 triggers on static 3rd-party API client calls[False Positive]

[githubmofo]

🔍 Rule ID

TG-SSRF-001 (User-controlled Server-side URL Fetch)

⚠️ What is the problem?

When an application uses standard HTTP client libraries (such as axios, fetch, or Python requests) with hardcoded external API URLs, AI agents sometimes flag this as an SSRF vulnerability simply because an outbound request was detected.

💻 Code Example (Safe Code Flagged as Unsafe)

// Harmless static external API call
const response = await axios.get("https://api.github.com/users/" + username);