Development address in shipped code
Scan rule · RSC-ARC-012
- Architecture & SEO
- Severity: Low
Finds calls to localhost, 127.0.0.1, private network addresses or tunnels (ngrok) in the shipped JavaScript — leftovers from development that go nowhere for users.
Why this matters
AI tools like to write the backend address as a fallback into the code: `import.meta.env.VITE_API_URL || "http://localhost:3000"`. As long as the variable is missing at build time, that fallback ends up in the shipped bundle — and the app calls the developer's own machine for every user.
For your users the call goes nowhere: an empty form, a spinner that never ends. If a tunnel (ngrok, localhost.run) is still running there, the call lands on a machine nobody operates or secures.
Verify: open the bundle in the browser and search for `localhost`, `127.0.0.1` or `ngrok`. Fix: read the address only from the environment variable, remove the fallback, rebuild with the variable set.
Scan tier
- External scan (anonymous)
How to fix it
Read the address from an environment variable, drop the fallback and rebuild with the variable set.