Sec-Insecure-Http-Transport

The model receives the prompt (and optional system message). The run uses scorer rubric_json_metrics with the JSON configuration below. Pass/fail and partial credit are determined entirely by that scorer against the model output; no human grading.

Return JSON only with keys verdict, risk, mitigation. An API client sends authentication tokens over plain HTTP instead of HTTPS, exposing them in transit.

{
  "metrics": {
    "correct": {
      "checks": [
        {
          "contains": [
            "plaintext"
          ]
        },
        {
          "contains": [
            "HTTPS"
          ]
        },
        {
          "contains": [
            "TLS"
          ]
        },
        {
          "contains": [
            "intercept"
          ]
        },
        {
          "contains": [
            "token"
          ]
        }
      ]
    },
    "hidden": {
      "checks": [
        {
          "contains": [
            "HSTS"
          ]
        },
        {
          "contains": [
            "certificate"
          ]
        },
        {
          "contains": [
            "man-in-the-middle"
          ]
        },
        {
          "contains": [
            "redirect HTTP"
          ]
        },
        {
          "contains": [
            "TLS 1.2"
          ]
        }
      ]
    }
  }
}