Hardcoded Development URLs

Description

Detects hardcoded development URLs (localhost, 127.0.0.1) in production code that should use environment variables.

What Shoulder detects

Hardcoded development URL found: {code}
Development URLs like localhost should be configured via environment variables.

How to fix

Replace hardcoded URLs with environment variables:

Before: const API_URL = 'http://localhost:3000';
After:  const API_URL = process.env.API_URL || 'http://localhost:3000';

For database connections:
Before: host: 'localhost'
After:  host: process.env.DB_HOST || 'localhost'

Applies to

Languages

🟨 JavaScript 🔷 TypeScript

Frameworks

express fastify nodejs

References

Documentation ↗ Learn about CWE-547

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=javascript-hardcoded-dev-urls .