SG-012: Suspicious URL

Severity: MEDIUM

HTTP URLs, IP-address URLs, non-standard ports, URL shorteners

Fires when

• A plain HTTP (non-HTTPS) URL points at a public host (loopback, private IPs, *.local/*.localhost, and Tailscale hosts excluded).
• A URL targets a raw public IP address, or uses a non-standard 4-5 digit port.
• A URL-shortener link (bit.ly, tinyurl.com, t.co, goo.gl, ow.ly) or an ngrok tunnel URL appears; standard XML/RDF namespace URLs (w3.org, schema.org) are skipped.

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.