The reference implementation&#x27;s domain is vulnerable to MITM attacks between KeeWeb and CloudFlare until they set their CloudFlare crypto settings to &quot;strict&quot; and get some real certificates of their own (e.g. Let&#x27;s Encrypt).<p>I submitted an issue here: <a href="https:&#x2F;&#x2F;github.com&#x2F;antelle&#x2F;keeweb&#x2F;issues&#x2F;111" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;antelle&#x2F;keeweb&#x2F;issues&#x2F;111</a><p>Of course exploiting this would be very difficult, but it is <i>possible</i> to MITM the connection between the CloudFlare proxy and GitHub pages as long as keeweb.info continues to not use DNSSEC.