Cleartext HTTP (ARCH3118)

Key typescript.security.cleartext-http · Severity warning · Category security · CWE CWE-319

Sending sensitive data over http:// lets the traffic be sniffed and tampered with on the network. Make all external calls over TLS.

Incorrect

const res = await fetch("http://api.example.com/login", {
  method: "POST",
  body: JSON.stringify({ username, password }),
});

Correct

const res = await fetch("https://api.example.com/login", {
  method: "POST",
  body: JSON.stringify({ username, password }),
});

Fix

Use https:// for all endpoints; never carry sensitive traffic over plaintext HTTP.