Whether requests to baseUrl would travel unencrypted, as one sentence for a
warning (no prefix), or undefined when they would not: for
https:, for a URL that does not parse, and for a loopback host (localhost,
127.0.0.0/8, ::1), where nothing leaves the machine.
The sentence names the host (url.host: host and port, never the userinfo) and what
secret travels with the requests: the base URL's credentials when it carries
userinfo (which baseUrlProblem rejects for a client, but the check stays general),
and every phrase in secrets — noun phrases such as "the token" or "the login".
It never contains a password or token. The CLI logs it once per run as a
WARN record of regstat.http on stderr.
Whether requests to
baseUrlwould travel unencrypted, as one sentence for a warning (no prefix), orundefinedwhen they would not: forhttps:, for a URL that does not parse, and for a loopback host (localhost, 127.0.0.0/8,::1), where nothing leaves the machine.The sentence names the host (
url.host: host and port, never the userinfo) and what secret travels with the requests: the base URL's credentials when it carries userinfo (whichbaseUrlProblemrejects for a client, but the check stays general), and every phrase insecrets— noun phrases such as"the token"or"the login". It never contains a password or token. The CLI logs it once per run as aWARNrecord ofregstat.httpon stderr.