A public letter to CloudFlare to fix their snoopy vendor
I also tried reporting this issue to Cloudflare in the past through their hackerone page (since I was out of ideas where to get the request though), this is the response I got:<p>> Enabling SSL/TLS between Cloudflare and the origin site is a customer decision. When this protection is not enabled, as is the case here, <i>an ISP can manipulate the requests before they reach Cloudflare</i>. If this behaviour is not desired, the customer must change the settings for the site in the Cloudflare dashboard.<p>The request in question gets MITMed after it reaches Cloudflare edge servers, the connection between browser and the edge server happens over SSL