Private shard URLs are fetched server-side (SSRF-safe) to verify chain seed integrity.
Provide authenticated endpoints you control. Not stored, not logged.