xiaohongshu-darkhorse

The code retrieves a REDFOX_API_KEY from the environment or shell startup files and sends it to redfox.hk:443 to fetch Xiaohongshu ranking data; it also writes ranking results locally. The service-oriented credential use is disclosed, but TLS certificate and hostname verification are disabled, so a man-in-the-middle could capture the API key or modify responses. It logs the key prefix and includes unescaped remote values in an HTML-generation path, whose article renderer currently returns empty output because author_html is undefined. Overall severity is moderate due primarily to the avoidable credential interception risk; no clear destructive or unauthorized data-theft behavior is evident.