{"record":{"id":"346f1d9cf94d51a5","repo":"bytedance/deer-flow","slug":"mem0-allow-insecure-http-must-be-a-boolean","errorCode":null,"errorMessage":"mem0 allow_insecure_http must be a boolean","messagePattern":"mem0 allow_insecure_http must be a boolean","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"backend/packages/harness/deerflow/agents/memory/backends/mem0/config.py","lineNumber":82,"sourceCode":"                \"allow_insecure_http\",\n                \"top_k\",\n                \"score_threshold\",\n                \"max_injection_chars\",\n                \"timeout_seconds\",\n                \"startup_policy\",\n            }\n            - _HOST_INJECTED_KEYS\n        )\n        if unknown:\n            raise ValueError(f\"mem0 backend_config has unknown keys: {sorted(unknown)}\")\n        if not isinstance(failure_policy, dict):\n            raise ValueError(\"mem0 failure_policy must be a mapping {read, write}\")\n        unknown_fp = set(failure_policy) - {\"read\", \"write\"}\n        if unknown_fp:\n            raise ValueError(f\"mem0 failure_policy has unknown keys: {sorted(unknown_fp)}\")\n        allow_insecure_http = cfg.get(\"allow_insecure_http\", False)\n        if not isinstance(allow_insecure_http, bool):\n            raise ValueError(\"mem0 allow_insecure_http must be a boolean\")\n\n        config = cls(\n            api_key_env=str(cfg.get(\"api_key_env\", \"MEM0_API_KEY\")),\n            base_url=str(cfg.get(\"base_url\", \"https://api.mem0.ai\")).rstrip(\"/\"),\n            allow_insecure_http=allow_insecure_http,\n            top_k=int(cfg.get(\"top_k\", 8)),\n            score_threshold=float(cfg.get(\"score_threshold\", 0.1)),\n            max_injection_chars=int(cfg.get(\"max_injection_chars\", 12000)),\n            timeout_seconds=float(cfg.get(\"timeout_seconds\", 10.0)),\n            startup_policy=str(cfg.get(\"startup_policy\", \"fail_fast\")),\n            read_policy=str(failure_policy.get(\"read\", \"fail_open\")),\n            write_policy=str(failure_policy.get(\"write\", \"log_and_drop\")),\n        )\n        if config.startup_policy not in _STARTUP_POLICIES:\n            raise ValueError(f\"mem0 startup_policy must be one of {sorted(_STARTUP_POLICIES)}\")\n        if config.read_policy not in _READ_POLICIES:\n            raise ValueError(f\"mem0 failure_policy.read must be one of {sorted(_READ_POLICIES)}\")\n        if config.write_policy not in _WRITE_POLICIES:","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/bytedance/deer-flow/blob/1dd6ba1acb03700589994b0366c5d1c7d05e2eff/backend/packages/harness/deerflow/agents/memory/backends/mem0/config.py#L64-L100","documentation":"Raised by Mem0Config.from_backend_config when memory.backend_config.allow_insecure_http is present but is not a Python bool. The flag opts into sending the API token over plaintext http:// base URLs and is checked with isinstance(x, bool) so that truthy strings ('true', 'yes') or integers (1) cannot silently enable an insecure posture via YAML coercion ambiguity.","triggerScenarios":"Writing allow_insecure_http: \"true\" (quoted string), allow_insecure_http: 1, or allow_insecure_http: 'yes' (a quoted string; unquoted yes/no/on/off do parse as bool in YAML 1.1) in backend_config.","commonSituations":"Config generated by Helm/templates that quotes all values; JSON-based config injection that serializes booleans as strings; hand-editing where the value was quoted for safety.","solutions":["Write the value as a bare YAML boolean: allow_insecure_http: true (or false)","If a template renders config, make sure it emits a real boolean, not a quoted string","Reconsider whether you need the flag at all — prefer an https base_url"],"exampleFix":"# before (config.yaml)\nmemory:\n  backend_config:\n    base_url: http://localhost:8080\n    allow_insecure_http: \"true\"   # string -> ValueError\n\n# after\nmemory:\n  backend_config:\n    base_url: http://localhost:8080\n    allow_insecure_http: true","handlingStrategy":"type-guard","validationCode":"def allow_insecure_shape_ok(backend_config: dict) -> bool:\n    v = (backend_config or {}).get(\"allow_insecure_http\", False)\n    return isinstance(v, bool)","typeGuard":"def is_strict_bool(v: object) -> bool:\n    \"\"\"allow_insecure_http is checked with isinstance(v, bool): quoted 'true' / 1 are rejected.\"\"\"\n    return isinstance(v, bool)","tryCatchPattern":null,"preventionTips":["Emit booleans unquoted in YAML/JSON config pipelines (Helm values, JSON injection)","Prefer fixing base_url to https over enabling allow_insecure_http at all"],"tags":["config","mem0","memory","security","validation"],"backgroundTag":null,"analyzedSha":"1dd6ba1acb03700589994b0366c5d1c7d05e2eff","analyzedAt":"2026-08-14T21:20:34.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}