Function isInsecureSubURL

app.go:2027–2030

isInsecureSubURL reports whether subURL would expose the request over plaintext. Non-http(s) URLs (e.g. malformed input) are treated as insecure too — they'll fail downstream anyway, but the conservative answer avoids ever sending HWID to a non-https endpoint by mistake.

(subURL string)

// insecure too — they'll fail downstream anyway, but the conservative
// answer avoids ever sending HWID to a non-https endpoint by mistake.
func isInsecureSubURL(subURL string) bool {
	low := strings.ToLower(strings.TrimSpace(subURL))
	return !strings.HasPrefix(low, "https://")
}

// fetchSubscriptionFromURL fetches and parses a subscription. allowInsecure
// must be true to accept http:// URLs; when set, we also suppress the