@@ -1,4 +1,14 @@
-import { describe, expect, it } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockResolveHostAddresses } = vi.hoisted(() => ({
+  mockResolveHostAddresses: vi.fn(),
+}))
+
+vi.mock('@sim/security/dns', () => ({
+  resolveHostAddresses: mockResolveHostAddresses,
+  preferIpv4: (addresses: string[]) => addresses[0],
+}))
+
 import { executeSalesforceUpdateCustomFieldOperation } from '@/lib/internal/salesforce/operations/update-custom-field'
 
 const PARAMS = {
@@ -9,6 +19,10 @@ const PARAMS = {
 }
 
 describe('salesforce update custom field operation', () => {
+  beforeEach(() => {
+    vi.stubGlobal('fetch', vi.fn())
+  })
+
   it('rejects a field ID that could escape the CustomField path before provider work', async () => {
     await expect(
       executeSalesforceUpdateCustomFieldOperation({
@@ -26,4 +40,13 @@ describe('salesforce update custom field operation', () => {
       } as never)
     ).rejects.toThrow('Salesforce instance URL must be on a Salesforce domain')
   })
+
+  it('refuses a Salesforce host that resolves to a private address before sending the token', async () => {
+    mockResolveHostAddresses.mockResolvedValue({ addresses: ['10.0.0.5'] })
+
+    await expect(executeSalesforceUpdateCustomFieldOperation(PARAMS as never)).rejects.toThrow(
+      'instanceUrl resolves to a private or reserved address'
+    )
+    expect(fetch).not.toHaveBeenCalled()
+  })
 })