Bandit versions prior to 1.11.0 improperly trust the client-supplied URI scheme on plaintext HTTP/1.1 or h2c connections. This allows an unauthenticated attacker to spoof the transport security state by sending requests with an absolute-form URI scheme such as 'https', causing the application to treat plaintext connections as if they were TLS-protected. This can mislead downstream Plug components relying on conn.scheme for security decisions, such as skipping HTTP to HTTPS redirects, setting secure cookie flags, or enforcing CSRF protections.