KatLang parser is executed as Blazor webassembly app on client side, therefore your entered KatLang code is not sent to the server. But I agree, it needs https, especially when KatLang supports operators like 'load' which can load KatLang code from other sources. Loading part is inspired from Prolog predicate consult.

> therefore your entered KatLang code is not sent to the server

But that's not something that even client-side code supplied by HTTP should be capable of ensuring, considering that somebody could have intercepted it somewhere on the route and replaced it with something that does send it somewhere.

Page does not require any authentication and I wanted to make it simple. But too many people are asking about https, so I will configure https.

Ack on the simplicity part and not needing to talk to the server after the first load. But the main concern is that stuff could simply be injected on that first load.

Depending on how you host, the easiest solution might be to use the caddy web server which has letsencrypt built in.