The SSRF-safe client used a bare http.Transport, so HTTP_PROXY, HTTPS_PROXY and NO_PROXY were ignored. Clone the default transport and read the proxy from the environment when outgoingrequests.proxyurl is not set.