False positive: sec-hardcoded-url flags HTTP URLs in docstrings and default config values #364

Bug

The sec-hardcoded-url rule flags http:// URLs even when they appear in:

1. Docstrings / comments — documentation examples showing default values
2. Default configuration values — http://127.0.0.1:8767 as a localhost default

Example flagged code (false positive)

"""...
Config via uteke.json:
  UTEKE_SERVER_URL — uteke-serve HTTP URL (default: http://127.0.0.1:8767)
  Useful when running as a container (e.g., http://uteke:8767).
..."""

Why this is a false positive

• http://127.0.0.1:8767 is a localhost default — HTTPS on loopback is unnecessary and uncommon
• http://uteke:8767 is a Docker internal hostname — TLS is not needed for container-to-container communication on the same host
• These URLs are in docstrings, not in actual connection code
• The rule should distinguish between hardcoded production endpoints and localhost/internal-network defaults

Suggested fix

• Skip URLs in docstrings and comments
• Skip http://localhost, http://127.0.0.1, http://[::1], and http://<hostname> patterns (internal network)
• Only flag http:// URLs that point to external/public domains

Environment

• Repo where triggered: codecoradev/uteke PR #774
• Rule: sec-hardcoded-url
• File: extensions/hermes-memory-provider/init.py.tmpl (docstring lines)
• Scan URL: https://github.com/codecoradev/uteke/security/code-scanning/557