GHSA-3mqq-hv9c-85hc

### Impact

wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration.

If `.weblate`, `.weblate.ini`, or `weblate.ini` defines an API url, and the user supplies a token with `WLC_KEY` or `--key` without also pinning the URL, wlc would send the token to the project-configured URL.

Impacted users are those running wlc in untrusted repositories, pull request checkouts, or directories with untrusted ancestor configuration while using `WLC_KEY` or `--key`.

### Patches

The issue is patched in wlc 2.0.1 via https://github.com/WeblateOrg/wlc/pull/1500.

The fix rejects unscoped keys when the API URL comes from automatically discovered project configuration:

- `WLC_KEY` now requires `WLC_URL`. - `--key` now requires `--url`. - URL-scoped keys in the `[keys]` configuration section remain supported.

Users should upgrade to wlc 2.0.1 or newer.

### Workarounds

Without upgrading, users can avoid the issue by explicitly pinning the API URL whenever using an unscoped key:

`WLC_URL=https://hosted.weblate.org/api/ WLC_KEY=... wlc ...`

or:

`wlc --url https://hosted.weblate.org/api/ --key ... ...`

Alternatively, use URL-scoped keys in the [keys] section instead of WLC_KEY or --key, and avoid running wlc with secrets in untrusted checkouts.

- The issue was independently reported by [type5afe](https://hackerone.com/type5afe) and [visionx7](https://hackerone.com/visionx7) using HackerOne.