Everything so far could be read by anyone along the path, passwords included, unless something hides it.
HTTPS and TLS
Also called SSL
HTTPS is HTTP sent through TLS, an encrypted tunnel. TLS proves you reached the real site, hides what you send, and detects any change on the way. A padlock means the line is private, and says nothing about whether the site is honest.
A certificate is a site's proof of who it is. When a certificate error blocks an agent, the quick way past is to turn checking off, and it may just do that. The app then works and is open to anyone on the path. Treat a disabled check as a failed task, however many other checks pass.
“Never turn off certificate verification to get this working, so no verify=False and no curl -k. Find out why it fails, show me the output of curl -v https://api.example.com, and redirect all plain http traffic to https with a 308.”