fix: the external configuration loader fetches confi... in external.go

[orbisai0security]

Summary

Fix critical severity security issue in main/confloader/external/external.go.

Vulnerability

Field	Value
ID	V-002
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-002
File	main/confloader/external/external.go:52

Description: The external configuration loader fetches configuration over HTTP using client.Do(&http.Request{...}). v2ray configuration files typically contain highly sensitive data including proxy server addresses, authentication credentials (usernames, passwords, UUIDs), inbound/outbound routing rules, and potentially TLS private keys. When fetched over plain HTTP, the entire configuration payload is transmitted in cleartext and is visible to any passive network observer on the path between the v2ray instance and the configuration server — no active attack is required. This is distinct from V-001 (active MITM tampering) in that it requires only passive observation.

Changes

• main/confloader/external/external.go

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security