T09 · Insecure Skill Coding Practices
Error
- Location
handlers/_http.js:1- Finding
Cleartext HTTP Transport Exposes Sensitive Customer and Business Operations
- Content
View full analysis
{ if (v !== undefined && v !== null && v !== '') { url.searchParams.set(k, String(v)); } }); } const normalizedBody = body ? withDefaults(body) : null; if (normalizedBody) { const shopErr = ensureShopId(normalizedBody); if (shopErr) { return shopErr; } } const init = { method, headers: { Accept: 'application/json', ...(normalizedBody ? { 'Content-Type': 'application/json' } : {}), ...(normalizedBody ? buildContextHeaders(normalizedBody) : {}), ...(headers || {}), }, }; if (normalizedBody) { init.body = JSON.stringify(normalizedBody); } const response = await fetch(url.toString(), init); ``` ### Technical Analysis The default backend endpoint uses unencrypted HTTP. All handlers rely on the shared `request` function, so this transport affects both read-only requests and state-changing operations. Requests may carry the following information in ...[truncated 2402 chars]- Remediation
View remediation