{"record":{"id":"efd44f07aa087765","repo":"chocolatey/choco","slug":"warning-the-specified-source-0-is-not-secure","errorCode":null,"errorMessage":"WARNING! The specified source '{0}' is not secure.\n Sending apikey over insecure channels leaves your data susceptible to\n hackers. Please update your source to a more secure source and try again.\n\n Use --force if you understand the implications of this warning or are\n accessing an internal feed. If you are however doing this against an\n internet feed, then the choco gods think you are crazy. ;-)\n\nNOTE: For chocolatey.org, you must update the source to be secure.","messagePattern":"WARNING! The specified source '(.+?)' is not secure\\.\n Sending apikey over insecure channels leaves your data susceptible to\n hackers\\. Please update your source to a more secure source and try again\\.\n\n Use --force if you understand the implications of this warning or are\n accessing an internal feed\\. If you are however doing this against an\n internet feed, then the choco gods think you are crazy\\. ;-\\)\n\nNOTE: For chocolatey\\.org, you must update the source to be secure\\.","errorType":"validation","errorClass":"ApplicationException","httpStatus":null,"severity":"error","filePath":"src/chocolatey/infrastructure.app/commands/ChocolateyPushCommand.cs","lineNumber":111,"sourceCode":"                }\r\n            }\r\n\r\n            // security advisory\r\n            if (!configuration.Force || configuration.Sources.ToLowerSafe().Contains(\"chocolatey.org\"))\r\n            {\r\n                if (remoteSource.Scheme == \"http\" && remoteSource.Host != \"localhost\")\r\n                {\r\n                    var errorMessage =\r\n                        @\"WARNING! The specified source '{0}' is not secure.\r\n Sending apikey over insecure channels leaves your data susceptible to\r\n hackers. Please update your source to a more secure source and try again.\r\n\r\n Use --force if you understand the implications of this warning or are\r\n accessing an internal feed. If you are however doing this against an\r\n internet feed, then the choco gods think you are crazy. ;-)\r\n\r\nNOTE: For chocolatey.org, you must update the source to be secure.\".FormatWith(configuration.Sources);\r\n                    throw new ApplicationException(errorMessage);\r\n                }\r\n            }\r\n        }\r\n\r\n        public virtual void HelpMessage(ChocolateyConfiguration configuration)\r\n        {\r\n            this.Log().Info(ChocolateyLoggers.Important, \"Push Command\");\r\n            this.Log().Info(@\"\r\nChocolatey will attempt to push a compiled nupkg to a package feed.\r\n\r\nA feed can be a local folder, a file share, the community feed\r\n ({0}), or a custom/private feed. For web\r\n feeds, it has a requirement that it implements the proper OData\r\n endpoints required for NuGet packages.\r\n\".FormatWith(ApplicationParameters.ChocolateyCommunityFeedPushSource));\r\n\r\n            \"chocolatey\".Log().Info(ChocolateyLoggers.Important, \"Usage\");\r\n            \"chocolatey\".Log().Info(@\"\r","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/chocolatey/choco/blob/0d5abdd10cc177a141e69547cad6935b419b6c17/src/chocolatey/infrastructure.app/commands/ChocolateyPushCommand.cs#L93-L129","documentation":"Thrown by ChocolateyPushCommand.Validate when the push target uses an insecure HTTP scheme (remoteSource.Scheme == 'http') and the host is not 'localhost', and either --force was not used OR the source is chocolatey.org. Chocolatey refuses to send an API key over an unencrypted channel. For chocolatey.org specifically, even --force will not bypass this check because the source must be HTTPS.","triggerScenarios":"Pushing to an 'http://' URL (not localhost) without --force. Or pushing to any chocolatey.org HTTP endpoint with or without --force. The check: scheme is http AND host != localhost AND (no --force OR host contains 'chocolatey.org').","commonSituations":"Internal feed configured with HTTP instead of HTTPS. Developer forgets to use HTTPS URL for community feed. A typo in the source URL drops the 's' from https.","solutions":["Change the source URL to HTTPS: 'choco push --source=\"https://push.chocolatey.org/\"'.","For internal HTTP feeds where you understand the risk, add --force: 'choco push --source=\"http://internal-feed/\" --force'.","For localhost development feeds, use http://localhost — the check exempts localhost.","For chocolatey.org, HTTPS is mandatory; --force cannot override it."],"exampleFix":"// before\nchoco push --source=\"http://push.chocolatey.org/\"\n// after\nchoco push --source=\"https://push.chocolatey.org/\"","handlingStrategy":"validation","validationCode":"// Reject insecure sources before calling push\nvar uri = new Uri(pushSource);\nif (uri.Scheme == \"http\" && uri.Host != \"localhost\")\n{\n    if (uri.Host.Contains(\"chocolatey.org\"))\n    {\n        Console.Error.WriteLine(\"chocolatey.org requires HTTPS. Update the source URL.\");\n        return;\n    }\n    if (!force)\n    {\n        Console.Error.WriteLine(\"Insecure HTTP source. Use HTTPS or pass --force.\");\n        return;\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always use HTTPS URLs for remote feeds.","For chocolatey.org, HTTPS is mandatory — --force cannot override.","Use http://localhost only for local development feeds."],"tags":["chocolatey","push-command","security","https","insecure"],"backgroundTag":null,"analyzedSha":"0d5abdd10cc177a141e69547cad6935b419b6c17","analyzedAt":"2026-08-13T18:33:03.301Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}