chocolatey/choco · error · ApplicationException

WARNING! The specified source '{0}' is not secure. Sending

Error message

WARNING! The specified source '{0}' is not secure.
 Sending apikey over insecure channels leaves your data susceptible to
 hackers. Please update your source to a more secure source and try again.

 Use --force if you understand the implications of this warning or are
 accessing an internal feed. If you are however doing this against an
 internet feed, then the choco gods think you are crazy. ;-)

NOTE: For chocolatey.org, you must update the source to be secure.

What it means

Thrown by ChocolateyPushCommand.Validate when the push target uses an insecure HTTP scheme (remoteSource.Scheme == 'http') and the host is not 'localhost', and either --force was not used OR the source is chocolatey.org. Chocolatey refuses to send an API key over an unencrypted channel. For chocolatey.org specifically, even --force will not bypass this check because the source must be HTTPS.

Source

Thrown at src/chocolatey/infrastructure.app/commands/ChocolateyPushCommand.cs:111

                }
            }

            // security advisory
            if (!configuration.Force || configuration.Sources.ToLowerSafe().Contains("chocolatey.org"))
            {
                if (remoteSource.Scheme == "http" && remoteSource.Host != "localhost")
                {
                    var errorMessage =
                        @"WARNING! The specified source '{0}' is not secure.
 Sending apikey over insecure channels leaves your data susceptible to
 hackers. Please update your source to a more secure source and try again.

 Use --force if you understand the implications of this warning or are
 accessing an internal feed. If you are however doing this against an
 internet feed, then the choco gods think you are crazy. ;-)

NOTE: For chocolatey.org, you must update the source to be secure.".FormatWith(configuration.Sources);
                    throw new ApplicationException(errorMessage);
                }
            }
        }

        public virtual void HelpMessage(ChocolateyConfiguration configuration)
        {
            this.Log().Info(ChocolateyLoggers.Important, "Push Command");
            this.Log().Info(@"
Chocolatey will attempt to push a compiled nupkg to a package feed.

A feed can be a local folder, a file share, the community feed
 ({0}), or a custom/private feed. For web
 feeds, it has a requirement that it implements the proper OData
 endpoints required for NuGet packages.
".FormatWith(ApplicationParameters.ChocolateyCommunityFeedPushSource));

            "chocolatey".Log().Info(ChocolateyLoggers.Important, "Usage");
            "chocolatey".Log().Info(@"

View on GitHub (pinned to 0d5abdd10c)

Solutions

1. Change the source URL to HTTPS: 'choco push --source="https://push.chocolatey.org/"'.
2. For internal HTTP feeds where you understand the risk, add --force: 'choco push --source="http://internal-feed/" --force'.
3. For localhost development feeds, use http://localhost — the check exempts localhost.
4. For chocolatey.org, HTTPS is mandatory; --force cannot override it.

Example fix

// before
choco push --source="http://push.chocolatey.org/"
// after
choco push --source="https://push.chocolatey.org/"

// Reject insecure sources before calling push
var uri = new Uri(pushSource);
if (uri.Scheme == "http" && uri.Host != "localhost")
{
    if (uri.Host.Contains("chocolatey.org"))
    {
        Console.Error.WriteLine("chocolatey.org requires HTTPS. Update the source URL.");
        return;
    }
    if (!force)
    {
        Console.Error.WriteLine("Insecure HTTP source. Use HTTPS or pass --force.");
        return;
    }
}

When it happens

Trigger: Pushing to an 'http://' URL (not localhost) without --force. Or pushing to any chocolatey.org HTTP endpoint with or without --force. The check: scheme is http AND host != localhost AND (no --force OR host contains 'chocolatey.org').

Common situations: Internal feed configured with HTTP instead of HTTPS. Developer forgets to use HTTPS URL for community feed. A typo in the source URL drops the 's' from https.

Related errors

• The default push source configuration is not set. Either pas
• Multiple sources are not supported by push command.
• An API key was not found for '{0}'. You must either set an A
• When FIPS Mode is enabled, Chocolatey requires {0} feature a
• Automatic package creation from installer files only availab

AI-assisted analysis of chocolatey/choco@0d5abdd10c (2026-08-13). Data as JSON: /api/errors/efd44f07aa087765. Report an issue: GitHub.