Hardcoded localhost/port URL
Part of Architecture & Best Practices, which counts for 15% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
Hardcoding localhost or a fixed port instead of reading from environment/config breaks non-local deploys.
Why it matters
A URL pointing at localhost or 127.0.0.1 only works on the machine it was written on. Once the app is deployed, those requests fail or hit nothing, and the bug shows up as a feature that works in dev but silently breaks in production. It also blocks preview and staging environments that run on different hosts.
How to fix it
Move each base URL into configuration: an environment variable such as API_BASE_URL read via process.env in Node or os.environ in Python, with the localhost value kept in .env.development rather than in code. For frontend calls to your own backend, prefer relative paths like /api/users so the browser targets whatever host served the page. Commit a .env.example documenting the variable names.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo