From 8d530ae5a26ec83d53e6ebd63d431dd09cdf9456 Mon Sep 17 00:00:00 2001
From: Claude Agent <noreply@anthropic.com>
Date: Tue, 1 Sep 2026 13:11:40 +0000
Subject: [PATCH] feat(security): warn when SMB_ADDRESS uses plaintext http to
 a remote host

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 src/server.ts | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/server.ts b/src/server.ts
index 92739ad..7d0522a 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -14,6 +14,18 @@ if (!process.env.SMB_ADDRESS) {
   Log().warn('SMB_ADDRESS environment variable not set, using defaults');
 }
 
+try {
+  const smbUrl = new URL(SMB_ADDRESS);
+  const localHosts = ['localhost', '127.0.0.1', '::1'];
+  if (smbUrl.protocol === 'http:' && !localHosts.includes(smbUrl.hostname)) {
+    Log().warn(
+      `SMB_ADDRESS uses plaintext http:// to a remote host (${smbUrl.hostname}); SDP/ICE data will be sent unencrypted. Use https:// in production.`
+    );
+  }
+} catch (err) {
+  Log().warn(`SMB_ADDRESS could not be parsed as a URL: ${SMB_ADDRESS}`);
+}
+
 const ENDPOINT_IDLE_TIMEOUT_S: string =
   process.env.ENDPOINT_IDLE_TIMEOUT_S ?? '60';