Import a PWA

From an address

• The address must be https, with a valid certificate.
• The analyzer fetches the page, the web manifest and the icons.
• Redirects are followed with the same protections as the first request.

Refused addresses

To protect you from SSRF attacks, the analyzer refuses private or local addresses, cloud metadata addresses and redirects to those targets. The returned error code states the cause: see the error code catalog (for example URL_NOT_ALLOWED).

From an archive

A ZIP archive is uploaded through a pre-signed link then extracted with protections against crafted paths, symbolic links and archive bombs.