What travels unencrypted when requests go to baseUrl, as one sentence for a
warning (the CLI logs it as a WARN record) — or undefined when nothing does: an https: URL, a URL that does
not parse (the base-URL check reports that), or a loopback host (localhost,
127.0.0.0/8, ::1). The sentence names the host (url.host, host and port) and what
is sent with each request: the base URL's own credentials (userinfo) and any other
secret passed as a noun phrase in secrets (e.g. "the API key"). It never contains
a password or key. The CLI prints it once per run, before the first request.
What travels unencrypted when requests go to
baseUrl, as one sentence for a warning (the CLI logs it as aWARNrecord) — orundefinedwhen nothing does: anhttps:URL, a URL that does not parse (the base-URL check reports that), or a loopback host (localhost,127.0.0.0/8,::1). The sentence names the host (url.host, host and port) and what is sent with each request: the base URL's own credentials (userinfo) and any other secret passed as a noun phrase insecrets(e.g."the API key"). It never contains a password or key. The CLI prints it once per run, before the first request.