# NousResearch/hermes-agent · Cron provider key origin binding security fix

## Open now

- Nothing open on GitHub.

A bug where cron jobs matched stored provider keys against hostname only, allowing keys to be sent over HTTP, to different ports, or subdomains. The fix restricts key transmission to the provider's exact configured origin.

## TL;DR

- 3 member(s): 0 open issue(s), 1 closed issue(s), 0 open PR(s), 1 merged PR(s), 1 PR(s) closed without merging.
- A fix was merged to main in PR #130611. Verify it addresses your case.
- **Recommended:** read PR #130611 (and any competing PRs below) before filing. Confirm the merged change covers your symptom.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `resolved` · deciding PR(s): `pr-130611`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_SPANNING`): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
- Pairwise link density `0.67`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Closed / duplicate issues

- #126300: \[Bug\]: cron base_url check matches the provider's hostname, not its origin (stored key can go over HTTP, to another port, or to a subdomain)

## Prior & competing PRs

- **#130611: Cron jobs send a stored provider key only to that provider's configured origin, not over HTTP, another port or a subdomain (#126300, salvage #126306)**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`
  - files: `hermes_cli/config_providers.py`, `tests/tools/test_cronjob_tools.py`, `tools/cronjob_job_args.py`, `website/docs/user-guide/features/cron.md`, `website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/features/cron.md`
- **#126306: fix(cron): bind a stored provider key to its configured origin, not its hostname**. closed without merge
  - maintainer direction: category `merged_via`; implication `superseded`; refs `fb5cbcb25a`, `#130611`

## Fix status

- Merged to main in PR #130611 (cited above). No release data is tracked. Verify downstream.
- Fix last verified (merged) `2026-10-03`.