Encryption in transit using TLS 1.2 or higher

Transmitting authentication tokens, session cookies, and personal data over cleartext HTTP exposes every byte to network-level interception — on public Wi-Fi, by ISPs, or via any on-path attacker. CWE-319 (Cleartext Transmission of Sensitive Information) and OWASP A02 (Cryptographic Failures) both flag this. NIST 800-53 SC-8 requires transmission confidentiality and integrity. Disabling certificate validation (rejectUnauthorized: false) is equally dangerous — it defeats TLS entirely, making the connection vulnerable to any man-in-the-middle. Modern hosting platforms (Vercel, Netlify) enforce TLS at the edge, but custom or self-hosted setups must be explicitly configured.

For self-hosted deployments, enforce TLS 1.2+ in nginx:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;

Never disable certificate validation in application code — remove any instance of rejectUnauthorized: false:

// Remove this from production code:
// https.request(url, { rejectUnauthorized: false }, callback)

// Default validates certificates:
https.request(url, callback)

Vercel and Netlify handle TLS automatically. For custom deployments, verify your HSTS header is set: Strict-Transport-Security: max-age=31536000; includeSubDomains.