Enforcing TLS: Claude Code and Insecure HTTP Endpoints

Correction note (2026-10-13). An earlier version of this article said ssg audit --rule no-http-endpoints lists past write attempts. That command does not exist. Use ssg audit search --rule-id no-http-endpoints. The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target. ssg eval reads the tool call as JSON on stdin and has no --content, --content-file, --file or positional form.

Describe the task

Claude Code is writing the API client configuration for your application. It hardcodes the base URL using HTTP:

const API_BASE = "http://api.production.example.com/v2";

HTTP endpoints transmit data in plaintext — any network observer between your client and server can read request bodies, auth tokens, and API responses. In production, this is a critical misconfiguration. SSG's no-http-endpoints rule flags the write.

# illustrative sample output
[BLOCK] write_file › src/config/api.ts — rule: no-http-endpoints
Reason: http:// URL detected in production source file.

Give SSG context

SSG intercepts write calls via the claude_code_hook integration (MCP Server or PreToolUse hook) and validates file content.

Required context

rule no-http-endpoints {
  enabled true
  priority 80
  severity error
  DENY write
  IF path NOT ENDS_WITH ".test.ts"
  AND path NOT ENDS_WITH ".spec.ts"
  AND content REGEX "http://[a-zA-Z0-9][^\s"']*\.(com|io|net|org|dev)"
  MESSAGE "http:// endpoint detected in source code. Use https:// for all external URLs."
}

Optional context

Add exceptions for localhost and Docker-internal URLs that legitimately use HTTP:

rule no-http-except-local {
  enabled true
  priority 80
  severity error
  DENY write
  IF content REGEX "http://(?!localhost|127\.0\.0\.1|0\.0\.0\.0|host\.docker\.internal)"
  AND content REGEX "\.com|\.io|\.net"
  MESSAGE "External http:// endpoint detected. Use https:// instead."
}

What SSG does

SSG reads the full file content and runs the regex before any bytes are written. Claude Code receives the block with your message and can fix the URL before retrying.

Ask the agent to use HTTPS

The write was blocked: it contained an http:// URL pointing to a public domain.
Replace all http:// URLs with https:// for external endpoints.
localhost and 127.0.0.1 URLs may remain as http://.

Apply to environment files too

rule no-http-in-env {
  enabled true
  priority 85
  severity error
  ASK write
  IF path ENDS_WITH ".env"
  AND content REGEX "http://[a-zA-Z0-9]"
  AND content NOT CONTAINS "localhost"
  PROMPT "http:// URL in .env file. Confirm this is intentional?"
  MESSAGE "http:// URL in .env file. Confirm this is intentional?"
}

Audit URL schemes across your codebase

After a large refactor, run ssg audit search --rule-id no-http-endpoints to see all historical write attempts that contained HTTP URLs — useful for identifying when the misconfiguration first appeared.

How your regex handles query strings and paths

The pattern http://[a-zA-Z0-9][^\s\"']*\.com matches URLs including paths and query strings up to the next whitespace or quote. Test edge cases with echo '{"tool":"Write","input":{"file_path":"src/config/api.ts","content":"http://example.com/api"}}' | ssg eval.

Check the rule against your test environment config

Development environments often use HTTP for local services. The NOT ENDS_WITH ".test.ts" path condition handles test files — add similar exclusions for environment-specific configs (config.dev.ts) if needed.