App Transport Security is disabled via NSAllowsArbitraryLoads or insecure HTTP exceptions.
Remove the ATS exception and require HTTPS with valid certificates for all endpoints.