SEC-040
Form submits to an insecure http:// address
HighDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
Form action URLs on an HTTPS page.
Why it matters
Whatever is typed into the form (often passwords or contact details) is sent unencrypted and can be read or changed on the network.
Recommended fix
Point the form at the https:// version of the address.
How to verify
Submit the form with the browser’s network tab open and confirm the request goes to an https:// URL.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-040: Form submits to an insecure http:// address
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Change the form action(s) in the evidence to https:// (or a relative path) and make sure the receiving endpoint is served over HTTPS.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Submit the form with the browser’s network tab open and confirm the request goes to an https:// URL.