> For AI agents: the complete documentation index is available at https://mfdoctor.kevinbeier.com/llms.txt, the full documentation bundle is available at https://mfdoctor.kevinbeier.com/llms-full.txt.

# `config/remote-http-insecure`

- Category: **security**
- Default severity: **warning**

## Issue

Remote code fetched over plain HTTP can be changed in transit.

## How to fix it

Serve non-local remotes over HTTPS and keep HTTP only for local development.

Suppress or retarget with `rules["config/remote-http-insecure"]` set to `"off"` or a severity, see [Suppressions and allowlists](https://mfdoctor.kevinbeier.com/suppressions.md).

## Sources

- [Official source](https://module-federation.io/configure/remotes.html)