[Rushaway]

Summary

• Steam Web API key sent in clear text: GetFriendList (used by @friends / @!friends) was requested over plain http://, with the API key in the key= query parameter. It now uses https://, like RelayHelper's Steam Web API call.
• No other change: ripext validates certificates with configs/ripext/ca-bundle.crt, which ships with the extension and is already used by every Discord webhook.
• Version bump 1.5.5 -> 1.5.6.

Since the key has been sent over plain HTTP until now, consider rotating it.

Test plan

• Compiles with spcomp 1.12.0.7259 and 1.13.0.7427 (same deps as CI), no warnings
• CI build passes
• With a Steam Web API key configured, @friends / @!friends still target the right players after they join
  🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[WareZ57]

LGTM.

One-line change: the GetFriendList request now goes to https://api.steampowered.com/... instead of http://, so the Steam Web API key no longer travels in clear text. ripext validates against its bundled ca-bundle.crt, which is already used for the other HTTPS calls, so no extra setup is needed. The request still fits in sRequest[256] (32-char key + 17-digit SteamID64). Version bump to 1.5.6 is fine.

Checked: read the diff and the surrounding code, CI build is green, and the HTTPS endpoint answers (HTTP 400 without a key, so the route exists over TLS).
Not tested: no runtime test on a game server, so @friends / @!friends with a real API key were not exercised.

Agree with rotating the key, since it has been sent over plain HTTP until now.