Config: unknown base_url host only warns — typo silently signs to attacker #250

Summary

A typo or a hostile env value such as KALSHI_API_BASE_URL=https://api.elections.kalsi.com/trade-api/v2 passes path-component validation (/trade-api/v2) and is only flagged with logger.warning. In production stacks where stdlib logging warnings are filtered, dropped, or merely indexed, every signed request — including the KALSHI-ACCESS-KEY header and the matching RSA-PSS signature — is delivered to the attacker. The signature itself is per-message and not directly replayable against Kalshi, but the API key id plus repeated signature samples are still credential-class material exfiltrated silently.

Location

• kalshi/config.py:123-130 — unknown-host warning

Evidence

if host not in _KNOWN_HOSTS and host not in _LOCAL_HOSTS:
    logger.warning(
        "KalshiConfig.%s host %r is not a known Kalshi "
        "endpoint (%s). Requests will be signed and sent there "
        "with your API key — verify this is intentional.",
        field_name,
        host,
        sorted(_KNOWN_HOSTS),
    )

Recommended fix

Default-fail on unknown hosts and require an explicit KalshiConfig(allow_unknown_host=True) (or a process-wide KALSHI_ALLOW_UNKNOWN_HOST=1) escape hatch for mock servers and proxies. Keep the warning as a fallback when the opt-in is set.

Severity & category

medium / security