The OpenAI-compatible client admits a plain-http base URL to LOCALHOST (or any case other than lower) through its case-insensitive loopback check, but net/http's proxy exclusion compares the host with localhost case-sensitively, so with HTTP_PROXY set the call is proxied and the bearer key crosses the proxy in cleartext, against the package doc and the adapters chapter, which say a call to this machine is never proxied.

The OpenAI-compatible client admits a plain-http base URL to LOCALHOST (or any case other than lower) through its case-insensitive loopback check, but net/http's proxy exclusion compares the host with localhost case-sensitively, so with HTTP_PROXY set the call is proxied and the bearer key crosses the proxy in cleartext, against the package doc and the adapters chapter, which say a call to this machine is never proxied.

Grounds

• pursued: no spelling of localhost sends a call through HTTP_PROXY or HTTPS_PROXY; shown wrong by a base URL to this machine that a fake proxy sees, which TestALocalhostBaseURLIsNeverProxiedWhateverItsCase would then fail on