diff --git a/github/client.go b/github/client.go
index 5520fe4..2532ef8 100644
--- a/github/client.go
+++ b/github/client.go
@@ -92,7 +92,7 @@ func asAPIError(err error) (*APIError, bool) {
 // clientConfig holds optional configuration for NewClient.
 type clientConfig struct {
 	allowInsecureHTTP bool
-	testBypass        bool // skip env gate (for tests only)
+	testBypass        bool // skip env gate; only WithAllowInsecureHTTPForTest (export_test.go) should set this
 }
 
 // ClientOption configures optional behavior of NewClient.
@@ -187,7 +187,7 @@ func NewClient(token, baseURL string, opts ...ClientOption) *Client {
 			slog.Warn("WithAllowInsecureHTTP enabled — credentials may be sent over plaintext",
 				"env", envAllowInsecure+"=1")
 		} else {
-			slog.Warn("WithAllowInsecureHTTP option ignored: set "+envAllowInsecure+"=1 to enable")
+			slog.Warn("WithAllowInsecureHTTP option ignored", "hint", "set "+envAllowInsecure+"=1 to enable")
 		}
 	}
 
@@ -269,7 +269,7 @@ func (c *Client) parseRetryAfter(value string) (time.Duration, bool) {
 // It avoids the allocation of url.Parse for a simple scheme check.
 func hasHTTPSScheme(rawURL string) bool {
 	const prefix = "https://"
-	return len(rawURL) >= len(prefix) && strings.HasPrefix(strings.ToLower(rawURL[:len(prefix)]), prefix)
+	return len(rawURL) >= len(prefix) && strings.EqualFold(rawURL[:len(prefix)], prefix)
 }
 
 // doRequest performs an HTTP request with retry on 429 rate limit responses.
diff --git a/github/client_test.go b/github/client_test.go
index 87fbcab..18de391 100644
--- a/github/client_test.go
+++ b/github/client_test.go
@@ -530,7 +530,6 @@ func TestDoRequest_RejectsHTTPWithToken(t *testing.T) {
 	}
 }
 
-
 func TestDoRequest_RejectsHTTPWithToken_RedactsQueryParams(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(200)
@@ -551,6 +550,7 @@ func TestDoRequest_RejectsHTTPWithToken_RedactsQueryParams(t *testing.T) {
 		t.Errorf("error message should contain redacted marker, got: %v", errMsg)
 	}
 }
+
 func TestDoRequest_AllowsHTTPWithoutToken(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(200)