fix: harden webhook transport and gate debug logging

Require HTTPS for outbound integration webhooks. Webhook URLs are
themselves secrets (Slack in particular), so an http:// endpoint leaked
both the URL and the alert payload in cleartext.

Disable DomainDebugLog in release builds. Every message used
privacy: .public, which opted out of OSLog redaction and wrote looked-up
domains to the unified log in shipped builds.

1 files changed, 1 insertions, 1 deletions

diff --git a/DomainDig/IntegrationService.swift b/DomainDig/IntegrationService.swift
index dba8034..9948441 100644
--- a/DomainDig/IntegrationService.swift
+++ b/DomainDig/IntegrationService.swift
@@ -555,7 +555,7 @@ private enum HTTPIntegrationClient {
         headers: [String: String],
         timeoutSeconds: Double
     ) async throws {
-        guard let url = URL(string: urlString) else {
+        guard let url = URL(string: urlString), url.scheme?.lowercased() == "https" else {
             throw IntegrationError.invalidURL
         }