diff --git a/notes/bf-5tbku.md b/notes/bf-5tbku.md
new file mode 100644
index 0000000..ba0c9b1
--- /dev/null
+++ b/notes/bf-5tbku.md
@@ -0,0 +1,54 @@
+# bf-5tbku Verification Note
+
+## Task: Run TH-05-ssrf-block tests for pdftract-cli with timeout protection
+
+## Execution Summary
+
+**Command Run:**
+```bash
+timeout --kill-after=10s 60s cargo test --test TH-05-ssrf-block --package pdftract-cli
+```
+
+**Results:**
+- Total tests run: 7
+- Passed: 7
+- Failed: 0
+- Duration: 0.24 seconds
+- Exit code: 0 (success)
+
+## Acceptance Criteria Status
+
+| Criterion | Status | Details |
+|------------|--------|---------|
+| Command completes within 60 seconds | ✅ PASS | Completed in 0.24s |
+| No TIMEOUT or TERMINATED status | ✅ PASS | All tests completed normally |
+| No orphaned pdftract mcp processes | ✅ PASS | Verified with pgrep - no processes found |
+| No orphaned TH-05 processes | ✅ PASS | Verified with pgrep - no processes found |
+| Exit code indicates success | ✅ PASS | Exit code 0, all 7 tests passed |
+
+## Tests Executed
+
+All 7 SSRF-blocking tests passed:
+1. `test_cloud_metadata_blocked` - Blocks cloud metadata endpoints (169.254.169.254)
+2. `test_http_scheme_rejected` - Rejects non-HTTPS URLs
+3. `test_ipv4_wildcard_blocked` - Blocks 0.0.0.0/8
+4. `test_ipv4_loopback_blocked` - Blocks 127.0.0.0/8
+5. `test_no_network_connection_attempted` - Verifies no actual network connections
+6. `test_ipv6_loopback_blocked` - Blocks ::1/128
+7. `test_rfc1918_private_blocked` - Blocks RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
+
+## Process Cleanup Verification
+
+```bash
+# Checked for pdftract mcp processes
+pgrep -f 'pdftract mcp' | grep -v ^$$
+# Result: No processes found
+
+# Checked for TH-05 processes  
+pgrep -f TH-05 | grep -v ^$$
+# Result: No processes found
+```
+
+## Conclusion
+
+All acceptance criteria met. The TH-05 SSRF-blocking test suite executes cleanly with no timeout issues and leaves no orphaned processes.