fix(security): removed http warnings

Author: Chrilleweb

.changeset/huge-kings-make.md

@@ -0,0 +1,5 @@
+---
+'dotenv-diff': patch
+---
+
+removed warning on detecting http URLs

packages/cli/src/core/security/secretDetectors.ts

@@ -41,7 +41,7 @@ export const PROVIDER_PATTERNS: RegExp[] = [
 const LONG_LITERAL = /["'`]{1}([A-Za-z0-9+/_\-]{24,})["'`]{1}/g;
 
 // Regex for detecting HTTPS URLs
-const HTTPS_PATTERN = /["'`](https?:\/\/(?!localhost)[^"'`]*)["'`]/g;
+const HTTPS_PATTERN = /["'`](https:\/\/(?!localhost)[^"'`]*)["'`]/g;
 
 // List of harmless URL patterns to ignore
 const HARMLESS_URLS = [
@@ -296,15 +296,15 @@ export function detectSecretsInSource(
       const url = httpsMatch[1];
       if (url && !looksHarmlessLiteral(url)) {
         if (ignoreUrlsMatch(url, opts?.ignoreUrls)) continue;
-        const protocol = url.startsWith('https') ? 'HTTPS' : 'HTTP';
 
         findings.push({
           file,
           line: lineNo,
           kind: 'pattern',
-          message: `${protocol} URL detected – consider moving to an environment variable`,
+          message:
+            'HTTPS URL detected – consider moving to an environment variable',
           snippet: line.trim().slice(0, 180),
-          severity: protocol === 'HTTP' ? 'medium' : 'low',
+          severity: 'low',
         });
       }
     }

packages/cli/test/unit/core/security/secretDetectors.test.ts

@@ -351,13 +351,11 @@ const token = "AKIAIOSFODNN7EXAMPLE";
       expect(findings[0].message).toContain('HTTPS URL detected');
     });
 
-    it('should detect HTTP URLs as medium severity', () => {
+    it('should not detect HTTP URLs as medium severity', () => {
       const source = 'const apiUrl = "http://api.realservice.com/endpoint";';
       const findings = detectSecretsInSource('test.ts', source);
 
-      expect(findings).toHaveLength(1);
-      expect(findings[0].severity).toBe('medium');
-      expect(findings[0].message).toContain('HTTP URL detected');
+      expect(findings).toHaveLength(0);
     });
 
     it('should ignore URLs from ignoreUrls config', () => {