Protect production urls from manipulation

.github/copilot-instructions.md

@@ -0,0 +1,42 @@
+# Omise Python SDK — Security & Code Review Instructions
+
+## Code Review Checklist
+
+When reviewing PRs or commits, Copilot should automatically flag:
+
+### 1. Non-Production Omise Hosts (CRITICAL)
+
+Flag any committed code containing Omise domains that do NOT match the official
+production domain pattern `*.omise.co`. This includes:
+
+- Omise domains with any prefix other than `api`, `vault`, or other official production services
+- Any `localhost` or `internal` patterns referencing Omise
+- Any non-production environment hosts
+
+## Critical Files Requiring Strict Review
+
+These files contain Omise endpoint/host constants and require additional scrutiny:
+
+### `omise/__init__.py` — CRITICAL SECURITY FILE
+
+This file defines the base URLs used throughout the Omise Python SDK for API
+and vault calls. It contains the production endpoint constants.
+
+**Changes to Block (Red Flag):**
+
+- Any change introducing a non omise.co domain for production endpoints
+- Hardcoding non-production Omise URLs in production code paths (regex: `https?://[a-zA-Z0-9.-]*omise[a-zA-Z0-9.-]*(?<!omise\.co)`)
+- Changing `api_main` or `api_vault` to anything other than the official production domains:
+	- `https://api.omise.co`
+	- `https://vault.omise.co`
+
+**Changes Requiring Manual Review (Yellow Flag):**
+
+- Any modification to `api_main` or `api_vault`
+- Changes to `_MainResource._request()`, `_VaultResource._request()`, or `_PublicResource._request()` that alter API or vault base URL selection
+- Introduction of new environment types or URL patterns
+
+**Allowed Modifications:**
+
+- Adding validation or documentation about URL formats
+- Refactoring method structure without changing returned URLs

.gitleaks.toml

@@ -0,0 +1,33 @@
+title = "Omise Python Gitleaks configuration"
+
+[extend]
+useDefault = true
+
+[[rules]]
+id = "non-production-omise-host"
+description = "Non-production Omise host"
+regex = '''(?:https?://)?((?:\b[a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]*omise[a-zA-Z0-9-]*\.co)'''
+secretGroup = 1
+
+  [[rules.allowlists]]
+  description = "Official Omise hosts"
+  regexes = [
+    '''^([A-Za-z0-9-]+\.)*omise\.co$''',
+  ]
+
+[[allowlists]]
+description = "Ignored generated files"
+paths = [
+  '''^\.tox/''',
+  '''^build/''',
+  '''^omise\.egg-info/''',
+  '''(^|/)__pycache__/''',
+  '''\.pyc$''',
+]
+
+[[allowlists]]
+description = "Ignore test tokens and mock credentials"
+regexTarget = "match"
+regexes = [
+  '''(?:skey|pkey|tokn)_test_[a-zA-Z0-9]+''',
+]

.pre-commit-config.yaml

@@ -0,0 +1,11 @@
+repos:
+  - repo: local
+    hooks:
+      - id: gitleaks
+        name: "gitleaks - Detect secrets and non-production Omise hosts"
+        description: "Detect secrets and non-production Omise hosts using gitleaks"
+        entry: gitleaks detect --verbose --redact --no-git --source . --config .gitleaks.toml
+        language: system
+        stages: [pre-commit]
+        always_run: true
+        pass_filenames: false

omise/test/test_production_urls.py

@@ -0,0 +1,9 @@
+import unittest
+
+import omise
+
+
+class ProductionUrlsTest(unittest.TestCase):
+    def test_api_urls_match_production_endpoints(self):
+        self.assertEqual(omise.api_main, 'https://api.omise.co')
+        self.assertEqual(omise.api_vault, 'https://vault.omise.co')