External API calls containing user data use HTTPS/TLS 1.2+

HTTP transmits data in plaintext — any network intermediary, including ISP-level traffic inspection, corporate proxies, and shared Wi-Fi routers, can read or modify the payload. An extension that sends user data over HTTP instead of HTTPS exposes that data to passive interception and active man-in-the-middle attacks. CWE-319 (Cleartext Transmission of Sensitive Information) directly describes this failure. GDPR Art. 32 requires appropriate technical measures to ensure data security in transmission; HTTP is not an appropriate measure for any data linked to a user. OWASP 2021 A02 and NIST SP 800-53 SC-8 both require confidentiality of transmitted data.

Replace every HTTP URL in fetch() and XMLHttpRequest calls with HTTPS equivalents:

// BAD — plaintext transmission
await fetch('http://api.example.com/user/profile', {
  method: 'POST',
  body: JSON.stringify(userData)
});

// GOOD — encrypted transmission
await fetch('https://api.example.com/user/profile', {
  method: 'POST',
  body: JSON.stringify(userData)
});

Also verify that your server enforces HSTS and TLS 1.2+ — an HTTPS URL that redirects to HTTP via server misconfiguration is as dangerous as a plain HTTP call. Run your endpoint through SSL Labs to confirm TLS configuration.