Three-layer defense for the AllowInsecureHTTP client option:

1. Environment gate: AllowInsecureHTTP() requires REVIEW_BOT_ALLOW_INSECURE=1
   env var. Without it, the option is silently ignored with a slog.Warn.

2. Warning log on activation: When the env gate IS satisfied, a slog.Warn
   fires at client construction time so operators notice in production logs.

3. Test bypass: AllowInsecureHTTPForTest() skips the env gate entirely,
   keeping test code clean (no t.Setenv needed in every test).

Additionally, doRequest now rejects HTTP URLs unless allowInsecureHTTP is set
on the client, providing defense-in-depth against credential leakage.

Closes #96

@@ -87,0 +113,4 @@
+// This is intended exclusively for tests using httptest.Server.
+func AllowInsecureHTTPForTest() ClientOption {
+	return func(c *clientConfig) {
+		c.allowInsecureHTTP = true

@@ -145,0 +189,4 @@
+	allowInsecure := false
+	if cfg.allowInsecureHTTP {
+		if cfg.testBypass {
+			allowInsecure = true

@@ -145,0 +183,4 @@
+			allowInsecure = true
+			slog.Warn("AllowInsecureHTTP enabled — credentials may be sent over plaintext",
+				"env", "REVIEW_BOT_ALLOW_INSECURE=1")
+		} else {

@@ -218,2 +270,4 @@
+}
+
 // doRequest performs an HTTP request with retry on 429 rate limit responses.
 // It respects the Retry-After header when present, supporting both integer

@@ -514,0 +534,4 @@
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(200)
+		w.Write([]byte(`{"ok":true}`))
+	}))

@@ -0,0 +1,14 @@
+package github

@@ -218,3 +271,4 @@
+
 // doRequest performs an HTTP request with retry on 429 rate limit responses.
 // It respects the Retry-After header when present, supporting both integer
 // seconds and HTTP-date formats (capped at maxRetryAfter).

@@ -87,0 +97,4 @@
+
+// AllowInsecureHTTP permits the client to send credentials over HTTP (non-TLS) URLs.
+// This is gated by the REVIEW_BOT_ALLOW_INSECURE=1 environment variable as a
+// defense-in-depth safeguard. If the env var is not set, the option is ignored

@@ -145,0 +173,4 @@
+		o(&cfg)
+	}
+
+	// Environment gate for AllowInsecureHTTP (defense-in-depth).

@@ -87,0 +93,4 @@
+type clientConfig struct {
+	allowInsecureHTTP bool
+	testBypass        bool // skip env gate (for tests only)
+}

@@ -145,0 +178,4 @@
+
+	// Environment gate for WithAllowInsecureHTTP (defense-in-depth).
+	// WithAllowInsecureHTTPForTest bypasses this gate for test convenience.
+	allowInsecure := false

@@ -514,0 +520,4 @@
+	defer srv.Close()
+
+	// Without WithAllowInsecureHTTP, should refuse to send token over HTTP
+	c := NewClient("secret-token", srv.URL)

@@ -0,0 +1,14 @@
+package github

@@ -87,0 +101,4 @@
+// WithAllowInsecureHTTP permits the client to send credentials over HTTP (non-TLS) URLs.
+// This is gated by the REVIEW_BOT_ALLOW_INSECURE=1 environment variable as a
+// defense-in-depth safeguard. If the env var is not set, the option is ignored
+// and a warning is logged.

@@ -215,10 +265,30 @@ func (c *Client) parseRetryAfter(value string) (time.Duration, bool) {
 	return 0, false
 }
 

@@ -511,3 +511,130 @@ func TestSetHTTPClient_NilRestoresDefault(t *testing.T) {
 		t.Fatal("expected CheckRedirect policy after SetHTTPClient(nil)")
 	}
 }

@@ -138,13 +165,36 @@ func defaultCheckRedirect(req *http.Request, via []*http.Request) error {
 // NewClient creates a new GitHub API client.

@@ -138,13 +165,36 @@ func defaultCheckRedirect(req *http.Request, via []*http.Request) error {
 // NewClient creates a new GitHub API client.
 // If baseURL is empty, it defaults to https://api.github.com.
 // For GitHub Enterprise, pass the API base URL (e.g. https://github.concur.com/api/v3).

@@ -144,1 +173,4 @@
 	}
+	var cfg clientConfig
+	for _, o := range opts {
+		o(&cfg)

@@ -138,0 +160,4 @@
+		cfg.allowInsecureHTTP = true
+	}
+}
+

@@ -138,0 +168,4 @@
+	return func(cfg *clientConfig) {
+		cfg.allowInsecureHTTP = true
+		cfg.insecureIsTestBypass = true
+	}

@@ -145,0 +192,4 @@
+			slog.Warn("AllowInsecureHTTP enabled — credentials may be sent over plaintext",
+				"env", "REVIEW_BOT_ALLOW_INSECURE=1")
+		}
+	}

@@ -215,10 +268,23 @@ func (c *Client) parseRetryAfter(value string) (time.Duration, bool) {
 	return 0, false
 }
 

@@ -511,3 +511,108 @@ func TestSetHTTPClient_NilRestoresDefault(t *testing.T) {
 		t.Fatal("expected CheckRedirect policy after SetHTTPClient(nil)")
 	}
 }
+

@@ -215,10 +268,23 @@ func (c *Client) parseRetryAfter(value string) (time.Duration, bool) {
 	return 0, false

@@ -218,0 +273,4 @@
+func redactURL(rawURL string) string {
+	if idx := strings.IndexByte(rawURL, '?'); idx != -1 {
+		return rawURL[:idx] + "?<redacted>"
+	}

@@ -135,16 +141,63 @@ func defaultCheckRedirect(req *http.Request, via []*http.Request) error {
 	return nil

@@ -138,0 +157,4 @@
+// For tests, prefer AllowInsecureHTTPForTest which bypasses the env gate.
+func AllowInsecureHTTP() ClientOption {
+	return func(cfg *clientConfig) {
+		cfg.allowInsecureHTTP = true

@@ -218,3 +279,4 @@
+
 // doRequest performs an HTTP request with retry on 429 rate limit responses.
 // It respects the Retry-After header when present, supporting both integer
 // seconds and HTTP-date formats (capped at maxRetryAfter).

@@ -237,7 +319,6 @@ func (c *Client) doRequest(ctx context.Context, method, reqURL string, accept st
 				timer := time.NewTimer(delay)

@@ -514,0 +551,4 @@
+	if err == nil {
+		t.Fatal("expected error for uppercase HTTP scheme")
+	}
+	if !strings.Contains(err.Error(), "refusing HTTP request") {

@@ -514,0 +605,4 @@
+		t.Errorf("body = %q, want %q", body, "insecure-ok")
+	}
+}
+

@@ -138,0 +154,4 @@
+// In production, this option is gated by the REVIEW_BOT_ALLOW_INSECURE=1
+// environment variable. Without the env var set, the option is silently ignored
+// and a warning is logged.
+//

@@ -140,3 +177,3 @@
 // For GitHub Enterprise, pass the API base URL (e.g. https://github.concur.com/api/v3).
-func NewClient(token, baseURL string) *Client {
+func NewClient(token, baseURL string, opts ...ClientOption) *Client {
 	if baseURL == "" {

@@ -145,0 +194,4 @@
+				"env", "REVIEW_BOT_ALLOW_INSECURE=1")
+		}
+	}
+

@@ -138,0 +165,4 @@
+// AllowInsecureHTTPForTest permits sending credentials over plaintext HTTP
+// without requiring the REVIEW_BOT_ALLOW_INSECURE environment variable.
+// This is intended exclusively for test code using httptest.Server.
+func AllowInsecureHTTPForTest() ClientOption {

@@ -142,3 +168,4 @@
+func NewClient(token, baseURL string, opts ...ClientOption) *Client {
 	if baseURL == "" {
 		baseURL = defaultBaseURL
 	}

@@ -218,0 +276,4 @@
+	u.Fragment = ""
+	return u.String()
+}
+

@@ -222,0 +287,4 @@
+			return nil, fmt.Errorf("parse request URL: %w", err)
+		}
+		if strings.EqualFold(parsed.Scheme, "http") {
+			return nil, fmt.Errorf("refusing HTTP request to %s: use HTTPS or set AllowInsecureHTTP option", redactURL(reqURL))

@@ -145,0 +172,4 @@
+
+	var cfg clientConfig
+	for _, opt := range opts {
+		opt(&cfg)

@@ -148,2 +190,4 @@
+		token:             token,
+		allowInsecureHTTP: cfg.allowInsecureHTTP,
 		httpClient: &http.Client{
 			Timeout:       30 * time.Second,

@@ -215,10 +259,40 @@ func (c *Client) parseRetryAfter(value string) (time.Duration, bool) {
 	return 0, false
 }
 

@@ -514,0 +533,4 @@
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Fatal("request should not have been sent")
+	}))
+	defer srv.Close()

@@ -138,0 +159,4 @@
+func AllowInsecureHTTP() ClientOption {
+	return func(cfg *clientConfig) {
+		cfg.allowInsecureHTTP = true
+	}

@@ -218,2 +276,4 @@
+}
+
 // doRequest performs an HTTP request with retry on 429 rate limit responses.
 // It respects the Retry-After header when present, supporting both integer

@@ -138,0 +157,4 @@
+//
+// For tests, use AllowInsecureHTTPForTest (defined in a _test.go file in the same package) which bypasses the env gate.
+func AllowInsecureHTTP() ClientOption {
+	return func(cfg *clientConfig) {

@@ -218,0 +267,4 @@
+	if err != nil {
+		return "<unparseable URL>"
+	}
+	u.User = nil

@@ -237,7 +310,7 @@ func (c *Client) doRequest(ctx context.Context, method, reqURL string, accept st
 				timer := time.NewTimer(delay)

@@ -222,0 +285,4 @@
+	if !c.allowInsecureHTTP {
+		parsed, err := url.Parse(reqURL)
+		if err != nil {
+			return nil, fmt.Errorf("parse request URL: %w", err)