No hardcoded localhost URLs in non-config source files
Why it matters
A hardcoded http://localhost:3000/api or ws://127.0.0.1:8080 in a shipped client works on exactly one machine: the developer's laptop. Every other environment — preview deploys, staging, production — fails as soon as the code runs, usually with opaque CORS or network errors. The defect often hides until after deploy because local dev still works, so it surfaces directly to users instead of in CI.
Severity rationale
Low because the break is loud and usually caught quickly in preview, but it still reaches users when config files slip past review.
Remediation
Read the base URL from environment variables and supply production-safe defaults. Put configuration in .env.local for dev and .env.production (or the platform's env panel) for deploy. Fix in src/lib/api-client.ts:
const API_URL = process.env.NEXT_PUBLIC_API_URL || '/api'
const WS_URL = process.env.NEXT_PUBLIC_WS_URL || 'wss://app.example.com/ws'
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the WIP-in-Production Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ai-slop-half-finished·automated