Ensure all API requests use `https.request` with `secureProtocol` set. Validate open-source packages don’t silently downgrade.