Upstream contribution · chunkhound/chunkhound
chunkhound · Distinguishing the official VoyageAI endpoint from look-alike hosts
Problem
ChunkHound classified an endpoint as official using a raw prefix check. Hostnames that appended a subdomain or hyphen suffix to api.voyageai.com could therefore enter configuration branches intended for VoyageAI's official service.
Engineering response
The check now requires the exact official base or a slash boundary after it, matching the guard used for the analogous OpenAI endpoint helper.
Evidence and scope
The author reports eight focused cases covering official forms and suffix spoofing. Reverting the implementation made both spoofing assertions fail again. The helper was loaded directly for local testing because the full package's optional parser and database dependencies were unavailable.