I recently found that a very popular web-service serves its api console over HTTP, rendering all API keys vulnerable to MITM. I sent over a mail to their securi

I recently found that a very popular web-service serves its api console over HTTP, rendering all API keys vulnerable to MITM. I sent over a mail to their security issues mail address. Still waiting for a response. Step 1 of securing an API: Use SSL.