SSRF to internal dashboards: a bug-bounty walkthrough

How a forgotten URL preview endpoint exposed an entire metadata service.