Scan rule · RSC-SEC-001
No end-to-end HTTPS
Checks whether the final response is served encrypted or ends up on plain http.
Why this matters
Without end-to-end HTTPS, everything travelling between browser and server goes in clear text — logins, forms, session cookies. On public Wi-Fi that is readable and modifiable.
A common cause in AI and no-code projects: the app itself runs encrypted, but a custom domain was placed in front without a certificate, or http does not permanently redirect to https. Both look unremarkable day to day.
For projects in Germany, Austria and Switzerland there is an added angle: transmitting personal data over an unencrypted connection is also attackable under data protection law. Fix: set up a certificate and force all http requests to https with a permanent redirect.
Scan tier
How to fix it
Set up a TLS certificate and permanently redirect all http requests to https.