Rules / CFG071

CFG071 model/provider base URL sends the API key over cleartext

Severity: error OWASP: LLM02:2026 – Sensitive Information Disclosure

What cfgaudit checks

Multi-provider AI tools let you point a model at a custom endpoint via a base URL — the provider API key is sent there. cfgaudit flags such a base URL when it uses cleartext (http:// / ws://) to a non-loopback host, because the key then travels unencrypted to a remote endpoint:

• Continue — models[].apiBase and data[].destination in .continue/config.yaml
• Codex — chatgpt_base_url and [model_providers.<name>].base_url in ~/.codex/config.toml

This is the multi-provider analogue of CFG005 (ANTHROPIC_BASE_URL).

Why only cleartext

A Continue data entry names where session content is exported to, so the same cleartext test applies, and what travels there is the session rather than the API key. When the entry also sets level: all, which the schema distinguishes from noCode precisely because it includes code, the message says so.

Only cleartext-to-remote is reported here, for the reason below and one more from measurement: the single real data block in a 108-config sample points at a file:// path on the author's own machine. A finding on any non-default destination would have been wrong on the only occurrence there is.

Unlike Claude Code (whose only valid endpoint is api.anthropic.com), Continue and Codex are multi-provider by design — Azure OpenAI, OpenRouter, internal gateways, and local Ollama are all legitimate custom endpoints. So a non-default endpoint is not flagged on its own; only the unambiguous cleartext-to-remote case (key sent in plaintext) is. https:///wss:// endpoints and loopback addresses are not flagged.

Trigger example

models:
  - name: gpt
    provider: openai
    apiBase: http://gateway.internal.example/v1
    apiKey: ${{ secrets.OPENAI_API_KEY }}

→ error (the key is sent over cleartext http:// to a remote host).

Safe alternative

models:
  - name: gpt
    provider: openai
    apiBase: https://gateway.internal.example/v1

(A loopback endpoint such as http://localhost:11434/v1 for a local Ollama is also fine.)

References

• CFG005 (ANTHROPIC_BASE_URL), CFG049 (remote MCP url), CFG068 (templated credential to a remote endpoint) — related endpoint/credential rules
• CFG065 (hardcoded inline apiKey in Continue config)

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation