mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 22:40:54 -07:00
the http scheme downgrade origin was queued against every target, so on a plain-http target the http://host probe is the target's own origin and any correct same-origin reflection was reported as a high-severity downgrade. mark that origin https-only and skip it when the target scheme is not https, where a downgrade is meaningless, while still firing it on https targets that genuinely trust the http origin.