Leftover hosts and addresses

Code that points at a staging, internal or local host tells attackers where to look.

What it is

Scripts sometimes carry addresses such as localhost:3000, staging.example.com, 10.0.0.5 or an internal service name left over from development.

Why it matters

Each address names a host that exists or used to exist. A staging host often has weaker protection than production. A local address breaks the feature for real visitors when the page tries to call it.

How Tenty checks it

Tenty reads this from the page and the script files every visitor receives. The check runs on every scan, and the finding names the place where it appears.

How to fix it

Replace the address with the production one through an environment variable read at build time, and rebuild. When the staging host is public, protect it or take it offline.

How to reproduce

curl -sS 'https://YOUR-APP/assets/app.js' | grep -o 'localhost:[0-9]*'

Use the address from the finding.