TL;DR: Instead of redirecting API calls from HTTP to HTTPS, make the failure visible. Either disable the HTTP interface altogether, or return a clear HTTP error response and revoke API keys sent over the unencrypted connection. Unfortunately, many well-known API providers don't currently do so. Updates 2024-05-24: Added the Google Bug Hunter Team response to the report that the VirusTotal API resp
![Your API Shouldn't Redirect HTTP to HTTPS](https://cdn-ak-scissors.b.st-hatena.com/image/square/bd3be351e622d920b2ceacacf96a42c7870bd12e/height=288;version=1;width=512/https%3A%2F%2Fjviide.iki.fi%2Fhttp-redirects-og.png)