docker-compose.yml:9 publishes port 3000 directly on all interfaces. The HTTPS checks (auth/http.ts:6, hosts/http.ts:5) read url.protocol, which comes from ORIGIN, so plain-HTTP requests to host:3000 count as HTTPS. The Origin check stops browser logins, but telemetry reporters or scripts pointed at that port send tokens unencrypted.
Fix
Publish 127.0.0.1:3000:3000, or attach the container only to the reverse proxy's network.
`docker-compose.yml:9` publishes port 3000 directly on all interfaces. The HTTPS checks (`auth/http.ts:6`, `hosts/http.ts:5`) read `url.protocol`, which comes from `ORIGIN`, so plain-HTTP requests to `host:3000` count as HTTPS. The Origin check stops browser logins, but telemetry reporters or scripts pointed at that port send tokens unencrypted.
**Fix**
- Publish `127.0.0.1:3000:3000`, or attach the container only to the reverse proxy's network.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
docker-compose.yml:9publishes port 3000 directly on all interfaces. The HTTPS checks (auth/http.ts:6,hosts/http.ts:5) readurl.protocol, which comes fromORIGIN, so plain-HTTP requests tohost:3000count as HTTPS. The Origin check stops browser logins, but telemetry reporters or scripts pointed at that port send tokens unencrypted.Fix
127.0.0.1:3000:3000, or attach the container only to the reverse proxy's network.