Zennoxa Shield
Rules / JavaScript / TypeScript
SHIELD-JS-012

Insecure HTTP usage (non-HTTPS)

mediumJavaScript / TypeScriptCWE-319CVSS 5.9

What it detects

Using HTTP instead of HTTPS exposes data to interception.

How to fix

Use HTTPS for all external connections.

Vulnerable — Shield flags thisbilling.js
// Charge a card via the billing partner API
async function createCharge(payload) {
  const response = await fetch("http://api.billing-partner.io/v1/charges", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify(payload),
  });
  return response.json();
}
Fixed — scans cleanbilling.js
// Charge a card via the billing partner API
async function createCharge(payload) {
  const response = await fetch("https://api.billing-partner.io/v1/charges", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify(payload),
  });
  return response.json();
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JS-012, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JS-012: Insecure HTTP usage (non-HTTPS) — Zennoxa Shield