Plaintext HTTP endpoint
MediumAV-NET-001NetworkCore pack
What it finds
A `http://` URL where the host is not `localhost`/`127.0.0.1`/`0.0.0.0`.
Why it matters
Traffic over plain HTTP can be observed or modified in transit, including credentials and execution payloads.
How to fix it
Use HTTPS for all non-local network calls.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- INSECURE_HTTP_ENDPOINT
- How it detects
- Looks for a specific risky pattern in the code or config.
- Confidence
- Definite: the risky setting is written plainly in the file.
- Scans
- Any source referencing network endpoints
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Webhook without visible signature verificationAV-NET-003 · High
- Server-side request to a caller-controlled URLAV-NET-004 · High
- TLS certificate verification disabledAV-NET-005 · High
- Code reaches the cloud metadata endpointAV-NET-006 · High
- Permissive CORS (wildcard origin)AV-NET-002 · Medium
- Remote MCP server over unencrypted HTTPAV-MCP-110 · Medium