No mixed content (HTTP resources on HTTPS pages)

Mixed content — HTTP resources loaded on an HTTPS page — exposes those resources to network interception and modification. An attacker on the same network can intercept an HTTP image, script, or stylesheet load and replace it with malicious content, even though the page itself was delivered over HTTPS. Browsers block active mixed content (scripts, iframes) but may load passive mixed content (images, audio) with a warning. CWE-319 applies directly — data transmitted over cleartext HTTP is exposed. OWASP A02 (Cryptographic Failures) lists hardcoded http:// resource URLs as a transport security failure that undermines the HTTPS guarantee users expect.

Replace every hardcoded http:// resource URL with https:// or a protocol-relative URL. Search systematically across all components and templates.

// WRONG: HTTP resource on HTTPS page (blocked or warned)
<img src="http://cdn.example.com/hero.jpg" />
<script src="http://analytics.example.com/track.js" />

// CORRECT: explicit HTTPS
<img src="https://cdn.example.com/hero.jpg" />

// ALSO CORRECT: protocol-relative (inherits page protocol)
<img src="//cdn.example.com/hero.jpg" />

// BEST: same-origin relative path
<img src="/images/hero.jpg" />

Search: grep -rn 'http://' src/ --include='*.tsx' --include='*.ts' --include='*.css'. The upgrade-insecure-requests CSP directive is a safety net for cases you miss, but the authoritative fix is correcting the URLs at source.