Strong v2 challenge; the declared resource URL downgrades HTTPS to HTTP.
Measured evidence
- PAYMENT-REQUIRED decoded successfully and all three offers were structurally valid.
- Bazaar metadata and browser header exposure were present.
- The protected HTTPS route declared http://api402x.com/dao-proposals as its resource URL.