func checkSchemaRegistry(ctx context.Context, r *Report, p map[string]string) {
    url := strings.TrimSpace(p["schema.registry.url"])
    if url == "" {
        return
    }
    // ⚠️ NO URL VALIDATION - ACCEPTS ANY URL!
    client := httpClientFromTLS(tlsConf, 8*time.Second)
    req, _ := http.NewRequestWithContext(ctx, "GET",
                                        strings.TrimRight(url, "/")+"/subjects", nil)
    resp, err := client.Do(req)

if rest := strings.TrimSpace(props["rest.proxy.url"]); rest != "" {
    // ⚠️ SAME VULNERABILITY - NO VALIDATION
    client := httpClientFromTLS(tlsConf, 8*time.Second)
    req, _ := http.NewRequest("GET", strings.TrimRight(rest, "/")+"/topics", nil)
    resp, err := client.Do(req)

// Add after line 817 (after mtuCheck function)

// isAllowedURL validates that a URL is safe to access
func isAllowedURL(rawURL string) error {
    u, err := url.Parse(rawURL)
    if err != nil {
        return fmt.Errorf("invalid URL: %w", err)
    }

    // Only allow HTTP(S) schemes
    if u.Scheme != "https" && u.Scheme != "http" {
        return fmt.Errorf("only HTTP(S) schemes allowed, got: %s", u.Scheme)
    }

    // Resolve hostname to IP
    host := u.Hostname()
    if host == "" {
        return fmt.Errorf("no hostname in URL")
    }

    // Resolve all IPs
    ips, err := net.LookupIP(host)
    if err != nil {
        return fmt.Errorf("cannot resolve host %s: %w", host, err)
    }

    // Block private/internal IPs
    for _, ip := range ips {
        if isPrivateIP(ip) {
            return fmt.Errorf("private/internal IP addresses not allowed: %s resolves to %s", host, ip)
        }
    }

    return nil
}

// isPrivateIP checks if an IP is in private/reserved ranges
func isPrivateIP(ip net.IP) bool {
    // Private IP ranges to block
    privateRanges := []string{
        "10.0.0.0/8",          // RFC1918
        "172.16.0.0/12",       // RFC1918
        "192.168.0.0/16",      // RFC1918
        "127.0.0.0/8",         // Loopback
        "169.254.0.0/16",      // Link-local (AWS metadata)
        "::1/128",             // IPv6 loopback
        "fc00::/7",            // IPv6 private
        "fe80::/10",           // IPv6 link-local
        "0.0.0.0/8",           // Current network
        "100.64.0.0/10",       // Shared address space
        "192.0.0.0/24",        // IETF protocol assignments
        "192.0.2.0/24",        // TEST-NET-1
        "198.18.0.0/15",       // Benchmarking
        "198.51.100.0/24",     // TEST-NET-2
        "203.0.113.0/24",      // TEST-NET-3
        "224.0.0.0/4",         // Multicast
        "240.0.0.0/4",         // Reserved
        "255.255.255.255/32",  // Broadcast
    }

    for _, cidr := range privateRanges {
        _, subnet, _ := net.ParseCIDR(cidr)
        if subnet.Contains(ip) {
            return true
        }
    }
    return false
}

func httpClientFromTLS(tlsConf *tls.Config, timeout time.Duration) *http.Client {
    tr := &http.Transport{
        TLSClientConfig: tlsConf,
        Proxy: http.ProxyFromEnvironment,
        IdleConnTimeout: 10 * time.Second,
    }

    return &http.Client{
        Transport: tr,
        Timeout: timeout,
        // ✅ ADD THIS: Validate redirects
        CheckRedirect: func(req *http.Request, via []*http.Request) error {
            if len(via) >= 3 {
                return fmt.Errorf("too many redirects (max 3)")
            }
            // Validate redirect URL
            if err := isAllowedURL(req.URL.String()); err != nil {
                return fmt.Errorf("redirect blocked: %w", err)
            }
            return nil
        },
    }
}

func checkSchemaRegistry(ctx context.Context, r *Report, p map[string]string, tlsConf *tls.Config) {
    url := strings.TrimSpace(p["schema.registry.url"])
    if url == "" {
        return
    }

    // ✅ ADD THIS: Validate URL before use
    if err := isAllowedURL(url); err != nil {
        addRow(r, Row{"schema-registry", url, L7HTTP, FAIL,
                     fmt.Sprintf("URL validation failed: %v", err),
                     "Schema Registry URL must be a valid HTTPS URL to a public endpoint"})
        return
    }

    // Rest of function remains the same...

// Add to loadProperties function (Line 346)
func loadProperties(path string) (map[string]string, error) {
    file, err := os.Open(path)
    if err != nil {
        return nil, err
    }
    defer file.Close()

    props := map[string]string{}
    scanner := bufio.NewScanner(file)

    for scanner.Scan() {
        line := strings.TrimSpace(scanner.Text())
        if line == "" || strings.HasPrefix(line, "#") {
            continue
        }
        parts := strings.SplitN(line, "=", 2)
        if len(parts) == 2 {
            key := strings.TrimSpace(parts[0])
            value := strings.TrimSpace(parts[1])

            // ✅ ADD THIS: Expand environment variables
            value = os.ExpandEnv(value)

            props[key] = value
        }
    }
    return props, scanner.Err()
}

// Add after loadProperties function
func validateFilePermissions(path string) error {
    info, err := os.Stat(path)
    if err != nil {
        return err
    }

    mode := info.Mode()

    // File should not be readable by group or others
    if mode.Perm()&0077 != 0 {
        return fmt.Errorf("file %s has insecure permissions %o (should be 0600)",
                         path, mode.Perm())
    }

    return nil
}

// Call in main() before loading properties
if err := validateFilePermissions(*propsFile); err != nil {
    fmt.Fprintf(os.Stderr, "Warning: %v\n", err)
    fmt.Fprintln(os.Stderr, "Hint: Run 'chmod 600 <file>' to secure it")
}

// Encrypt configuration files with age or similar
// Decrypt at runtime with passphrase or key file
func loadEncryptedProperties(path, keyFile string) (map[string]string, error) {
    // Implementation using age or similar encryption library
}

// AWS Secrets Manager
func getSecretFromAWS(secretName string) (string, error) {
    cfg, _ := config.LoadDefaultConfig(context.TODO())
    client := secretsmanager.NewFromConfig(cfg)
    result, err := client.GetSecretValue(context.TODO(), &secretsmanager.GetSecretValueInput{
        SecretId: aws.String(secretName),
    })
    if err != nil {
        return "", err
    }
    return *result.SecretString, nil
}

// Usage in properties:
// sasl.password=aws-secret://prod/kafka/password

import (
    "log/slog"
    "os"
)

// Global logger
var logger *slog.Logger

func init() {
    // JSON structured logging
    handler := slog.NewJSONHandler(os.Stderr, &slog.HandlerOptions{
        Level: slog.LevelInfo,
    })
    logger = slog.New(handler)
}

// After loading configuration (Line 1018)
logger.Info("configuration loaded",
    "file", *propsFile,
    "properties_count", len(props),
    "user", os.Getenv("USER"),
    "timestamp", time.Now())

// Before Kafka connection (Line 1084)
logger.Info("kafka connection attempt",
    "broker", host,
    "security_protocol", props["security.protocol"],
    "sasl_mechanism", props["sasl.mechanism"],
    "username", props["sasl.username"])  // Don't log password!

// After successful authentication
logger.Info("kafka authentication successful",
    "broker", host,
    "mechanism", props["sasl.mechanism"])

// On authentication failure
logger.Error("kafka authentication failed",
    "broker", host,
    "mechanism", props["sasl.mechanism"],
    "error", err)

// AI API usage (Line 165)
logger.Info("ai api request",
    "provider", c.config.Provider,
    "endpoint", c.config.APIEndpoint,
    "model", c.config.Model)

// In loadProperties (Line 346)
logger.Info("loading configuration file",
    "path", path,
    "size", info.Size())

// In checkLicense (Line 232)
logger.Info("license validation",
    "file", "license.key",
    "valid", true/false)

// Line 174
if resp.StatusCode != http.StatusOK {
    body, _ := io.ReadAll(resp.Body)
    return nil, fmt.Errorf("AI API returned a non-200 status code: %d %s",
                          resp.StatusCode, string(body))
    // ⚠️ Exposes full API error response
}

// Line 190
return nil, fmt.Errorf("could not unmarshal AI JSON response: %w. Raw response: %s",
                      err, apiResp.Choices[0].Message.Content)
// ⚠️ Exposes raw AI response content

// Line 174
if resp.StatusCode != http.StatusOK {
    body, _ := io.ReadAll(resp.Body)
    // ✅ Log full error, return sanitized message
    logger.Error("ai api error",
                 "status_code", resp.StatusCode,
                 "response_body", string(body))
    return nil, fmt.Errorf("AI API request failed with status %d", resp.StatusCode)
}

// Line 190
// ✅ Log full error, return generic message
logger.Error("ai response parse error",
             "error", err,
             "raw_response", apiResp.Choices[0].Message.Content)
return nil, fmt.Errorf("failed to parse AI response: %w", err)

if strings.HasPrefix(providerConfig.APIKey, "YOUR_") || providerConfig.APIKey == "" {
    fmt.Fprintf(os.Stderr, "Error: API key for provider '%s' is a placeholder...\n")
    os.Exit(1)
}
// ⚠️ Only checks prefix, doesn't validate key format

func validateAPIKey(provider, key string) error {
    if key == "" {
        return fmt.Errorf("API key is empty")
    }

    if strings.HasPrefix(key, "YOUR_") {
        return fmt.Errorf("API key is a placeholder")
    }

    // Provider-specific validation
    switch provider {
    case "openai":
        if !strings.HasPrefix(key, "sk-") || len(key) < 20 {
            return fmt.Errorf("invalid OpenAI API key format")
        }
    case "scalytics":
        if len(key) < 32 {
            return fmt.Errorf("invalid Scalytics API key format")
        }
    }

    return nil
}

// Usage
if err := validateAPIKey(providerConfig.Provider, providerConfig.APIKey); err != nil {
    fmt.Fprintf(os.Stderr, "Error: %v\n", err)
    os.Exit(1)
}