ai-slop/hardcoded-urlmanual fix

Hardcoded URL.

A deployment-specific URL in source: an API base, a staging host, a webhook endpoint. The code works in one environment and quietly calls it from all the others.

Examples

Flagged shape and clean shape.

Each example shows the exact code shape the rule is looking for, then the smallest version that keeps the intent without hiding risk or adding noise.

hardcoded-url.ts

✗ Flagged

const API_BASE_URL = 'https://api.staging.acme-internal.io/v2'

export const fetchOrders = () =>
  fetch(`${API_BASE_URL}/orders`).then((res) => res.json())

Why this trips

Deterministic line match: flags quoted `http(s)://` literals on lines that name a URL setting (`api`, `baseUrl`, `endpoint`, `host`, `webhook`, `url`, and similar) or whose host looks environment-specific (`api.`, `staging`, `dev`, `internal`).

hardcoded-url.ts

✓ Clean

const API_BASE_URL = process.env.ORDERS_API_URL

export const fetchOrders = () =>
  fetch(`${API_BASE_URL}/orders`).then((res) => res.json())

What changed

Read deployment-specific URLs from environment variables or a typed config module. Keep only stable public or documentation links inline.

Why an AI agent produces this

Agents paste the URL they were given to make a request work. Nothing marks it as configuration, so it ships.

Provenance

How this rule is justified.

Rule id

ai-slop/hardcoded-url

Enforcing engine

ai-slop

Detector strategy

Legitimate code that is NOT flagged

`example.com`, localhost and loopback addresses, well-known vendor APIs such as GitHub and Stripe, documentation and link contexts, lines that read from the environment, comments, docstrings, migrations, and non-production paths are not flagged.

Evidence

Introduced in aislop v0.9.5 alongside hardcoded-id; v0.9.6 stopped flagging localhost and loopback URLs.

← All patterns Run the local CLI →