diff --git a/lib/postizClient.js b/lib/postizClient.js
index 596efa0..796e643 100644
--- a/lib/postizClient.js
+++ b/lib/postizClient.js
@@ -10,6 +10,18 @@ const makePostizClient = (pluginCfg) => {
     const apiKey  = String((pluginCfg && pluginCfg.apiKey) || "");
 
     const request = async (method, endpoint, body) => {
+        // Guard the operator-set baseUrl before we ever send the sealed apiKey:
+        // reject unparseable / non-http(s) schemes (file:, gopher:, data:, ...).
+        // Private/self-hosted hosts are allowed by design (self-hosted Postiz).
+        let parsed;
+        try {
+            parsed = new URL(baseUrl);
+        } catch (e) {
+            throw new Error(`Postiz baseUrl is not a valid URL: ${baseUrl}`);
+        }
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+            throw new Error(`Postiz baseUrl must use http or https: ${baseUrl}`);
+        }
         const url     = `${baseUrl}${PATH_BASE}${endpoint}`;
         const headers = { [AUTH_HEADER]: apiKey };
         const init    = { method, headers };