danielmiessler/Fabric v1.4.536

on GitHub

Changes

PR #2289 by pcbeingused333 and ksylvan: fix(plugins): refuse plaintext http to remote hosts for OpenAI, Exolab and Codex

• Fixed a security issue where plaintext HTTP connections to remote hosts could expose API keys and prompts; OpenAI-compatible clients, Exolab, and Codex now require HTTPS.
• Allowed HTTP only for localhost, loopback addresses, and *.localhost, leaving all built-in defaults unchanged.
• Tightened server bind authentication by requiring API keys for binds using localhost subdomains.
• Consolidated Codex authentication and API endpoint security checks, with shared loopback detection across endpoint validation and middleware.
• Localized base URL validation errors across all supported locales.
• If you use an http:// base URL to a host other than localhost, change it to https:// or use a local tunnel. Otherwise the vendor is not loaded. Run with --debug=3 to see the reason.