I wonder if this golink service is also vulnerable to DNS rebinding. Briefly looking at the code, it seems likely: it relies on Tailscale's usual "assume anyone

I wonder if this golink service is also vulnerable to DNS rebinding. Briefly looking at the code, it seems likely: it relies on Tailscale's usual "assume anyone who can connect to the service is authorized" security model and doesn't check the Host header. But maybe there's some mitigation I'm missing.