>I’m now going to register notsteampowered.com, and bypass the bug in the code to deliver an exploit over https. Yeah, that's a good point. That's my mistake i

>I’m now going to register notsteampowered.com, and bypass the bug in the code to deliver an exploit over https. Yeah, that's a good point. That's my mistake in spitballing, but the vulnerability wouldn't exist in an implementation that properly checked the domain. Again, I 100% agree with you that it's fragile and not a good idea. I wouldn't design a system this way, and I would flag it if I reviewed an app that did this. I was just objecting to the idea that the discovery of any plaintext HTTP request is a bounty-worthy vulnerability.