Enforcing TLS: VS Code Copilot and Insecure HTTP Endpoints

Correction note (2026-10-13). The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target.

Describe the task

VS Code Copilot is connecting to a payment API. It hardcodes the endpoint with http:// — common in development environments that have since been promoted to production config:

const API_BASE = 'http://api.payments.example.com/v1';

SSG flags the write before the file is saved — HTTP endpoints transmit credentials in plaintext.

# illustrative sample output
[BLOCK] write › src/config/api.ts — rule: no-http-api-endpoints

Give SSG context

SSG evaluates VS Code Copilot's file write calls via the SSG MCP Server integration.

Required context

rule no-http-api-endpoints {
  enabled true
  priority 90
  severity error
  DENY write
  IF path MATCHES ".*\.(ts|tsx|js|jsx|json|env)$"
  AND content MATCHES "http://[a-z0-9.-]+\.(com|io|net|org|dev)"
  MESSAGE "HTTP endpoint detected. Use https:// — plaintext HTTP exposes credentials to network interception."
}

Optional context

Also enforce in environment files:

rule no-http-in-env {
  enabled true
  priority 95
  severity error
  DENY write
  IF path MATCHES ".*\.env.*"
  AND content CONTAINS "http://"
  MESSAGE "HTTP URL in environment config. All API URLs should use https://."
}

What SSG does

SSG checks the file content at write time before it reaches disk. The insecure URL is never saved — no man-in-the-middle window is opened.

Ask the agent to use HTTPS

http:// endpoint was blocked. Use https:// for all external API calls:
  const API_BASE = 'https://api.payments.example.com/v1';
For local development, use localhost with HTTP (exempted by your ALLOW rule).

Allowlist localhost for development

Localhost connections don't need TLS. Add a higher-priority ALLOW:

rule allow-localhost-http {
  enabled true
  priority 200
  severity info
  ALLOW write
  IF content MATCHES "http://localhost"
  OR content MATCHES "http://127\.0\.0\.1"
  MESSAGE "Plain HTTP to localhost is allowed for local development."
}

Test that your app rejects HTTP redirects

Configure your HTTP client to fail on HTTP redirects from HTTPS:

// axios example
const client = axios.create({
  maxRedirects: 0,  // fail on any redirect
  httpsAgent: new https.Agent({ rejectUnauthorized: true }),
});

This ensures no accidental downgrade across your stack.