Client content contains a supported localhost URL value
ShipReady found a supported localhost, loopback, or all-interface URL with a port where static client content indicates a URL value.
Why it matters
A development address in shipped client configuration should be reviewed because visitors' browsers interpret local addresses on their own devices.
How ShipReady detects it
What it inspects
ShipReady inspects fetched executable client content and supported inline regions for maintained localhost URL patterns in value-like positions, while excluding supported comments and policy-source contexts.
What triggers a finding
The rule triggers when a supported local address with a port appears in the scanner's recognised URL-value context.
What the evidence shows
The inspected client content contains a URL value matched by ShipReady's localhost-address heuristic.
Limits of this check
ShipReady does not make a request to the address, execute the client code, determine whether the value is used, or prove that a visitor action fails.
How to fix it
Review the public runtime configuration
Trace the value to its build or environment configuration and replace unintended development addresses with the intended deployment endpoint.
How to verify the change
Inspect the deployed client output
Redeploy and check that the relevant shipped configuration no longer contains the unintended local address.
Expected: The deployed client configuration uses the intended endpoint.