Cleartext HTTP (ARCH6118)

Key ruby.security.cleartext-http · Severity warning · Category security · CWE CWE-319

Sending sensitive data over http:// leaves traffic unencrypted and exposed to man-in-the-middle attacks. Use TLS (https://) for all endpoints.

Incorrect

require "net/http"

uri = URI("http://api.example.com/login")
res = Net::HTTP.post_form(uri, email: email, password: password)

Correct

require "net/http"

uri = URI("https://api.example.com/login")
res = Net::HTTP.post_form(uri, email: email, password: password)

Fix

Switch all remote endpoints to https:// and keep TLS validation enabled.