Hardcoded Development URLs

Description

Detects hardcoded development URLs such as localhost or 127.0.0.1 in production code. This indicates: 1. Configuration management issues 2. Potential production deployment problems 3. Leftover development/test code 4. API endpoints pointing to local services Development URLs should be configurable via environment variables.

What Shoulder detects

Development URL found at line {line}: {url}

How to fix

Replace hardcoded URLs with environment variables or configuration.

Applies to

Languages

🐍 Python

Frameworks

django flask fastapi

References

Documentation ↗ Learn about CWE-547

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=python-hardcoded-dev-urls .