mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
the wayback passive source used http while the crt.sh and certspotter sources use https. passive results flatten straight into findings, so an on-path attacker could tamper with the plaintext response to inject or strip historical urls. use https to match the other two sources. Co-authored-by: vmfunc <vmfunc.lc@gmail.com>