The problem

Sami pastes a news link in a team chat. Under the message, a card appears with the article’s title, a short description and a photo. Nobody in the chat had to open the page.

Someone fetched that page. If it was your server, an attacker can paste http://169.254.169.254/ instead, the address of the cloud metadata service. OWASP notes that SSRF "is often used to access and steal credentials and access tokens from metadata services".

You design the preview service: fetch the title and the image of any public page, and never reach an address inside your own network.