I immediately understood what he was saying right from the start. He even mentions there is an eventual https redirect, but the app should start with the https

I immediately understood what he was saying right from the start. He even mentions there is an eventual https redirect, but the app should start with the https request! I've got about 20 years of experience as a software dev. I probably would have written it differently, but at the same time .. I fully understood what he was saying immediately. There's nothing difficult to understand there. We're never even talking about HSTS or certificate pinning. We're just talking about the very first call from the mobile app to their website/api.