lintai docs

Appearance

Rule Reference

SEC365lintai-ai-securitypreviewclaude_settingswarn

Claude settings: non-HTTPS allowed HTTP hook URL

Claude settings allow non-HTTPS HTTP hook URLs in a shared committed config

Provider
lintai-ai-security
Surface
claude_settings
Scope
per_file
Tier
preview
Severity
warn
Confidence
high
Detection
structural
Remediation
message_only

Activation Model

Preset Membership

This rule is part of the builtin activation graph through these preset memberships.

previewmembership
claudemembership

Lifecycle

Stable Lifecycle Contract

State

stable_gated

Graduation rationale

Checks shared committed Claude settings for non-HTTPS `allowedHttpHookUrls` entries.

Deterministic signal basis

ClaudeSettingsSignals exact URL-scheme analysis over `allowedHttpHookUrls` entries in parsed Claude settings JSON.

Malicious corpus
claude-settings-http-hook-url
Benign corpus
claude-settings-http-hook-loopback-safe
structured evidence required remediation reviewed
Canonical note

Structural preview rule; deterministic today, but the preview contract may still evolve.

Nearby Signals

Related Rules

SEC361Claude settings: missing `$schema`Claude settings file is missing a top-level `$schema` referenceclaude_settingspreview
SEC363Claude settings: home-directory hook pathClaude settings hook command uses a home-directory path in a shared committed configclaude_settingspreview
SEC366Claude settings: dangerous HTTP hook host literalClaude settings allow dangerous host literals in `allowedHttpHookUrls`claude_settingspreview
SEC368Claude settings: repo-external absolute hook pathClaude settings hook command uses a repo-external absolute path in a shared committed configclaude_settingspreview
SEC381Claude settings: command hook missing `timeout`Claude settings command hook should set `timeout` in a shared committed configclaude_settingspreview
SEC382Claude settings: `matcher` on unsupported hook eventClaude settings should not use `matcher` on unsupported hook eventsclaude_settingspreview

Why It Matters ​

SEC365 flags committed Claude settings that allow non-HTTPS HTTP hook URLs through allowedHttpHookUrls.

This is useful because:

  • shared Claude settings in git should prefer transport-safe defaults that teams can review and trust
  • plain http:// hook endpoints are easier to intercept or tamper with than reviewed https:// endpoints
  • transport-policy mistakes in shared config are structural and easy for the community to understand

What Triggers ​

This rule applies only to committed Claude settings surfaces:

  • .claude/settings.json
  • claude/settings.json

It triggers when allowedHttpHookUrls contains a non-loopback URL that starts with http://.

It does not trigger on:

  • https:// hook URLs
  • loopback-only local development URLs such as http://localhost:8899/hook
  • fixture-like test/example paths

Examples ​

Bad:

json
{
  "allowedHttpHookUrls": [
    "http://hooks.example.test/notify"
  ]
}

Better:

json
{
  "allowedHttpHookUrls": [
    "https://hooks.example.test/notify"
  ]
}

Remediation ​

  • replace non-HTTPS hook allowlist entries with reviewed https:// endpoints
  • keep local development exceptions out of shared committed Claude settings when possible
  • treat transport policy in allowedHttpHookUrls as team-facing security configuration