Fix Sieve: Do not allow invalid certs in http_header function

CHANGELOG.md

@@ -11,7 +11,8 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If
 ## Changed
 
 ## Fixed
-- JMAP: `*/changes` methods leak ids of non-shared objects 
+- JMAP: `*/changes` methods leak ids of non-shared objects (reported by @5ud0er).
+- Sieve: Do not allow invalid certs in `http_header` function.
 
 ## [0.16.8] - 2026-06-06
 

crates/common/src/scripts/plugins/http.rs

@@ -26,11 +26,15 @@ pub async fn exec_header(ctx: PluginContext<'_>) -> trc::Result<Variable> {
         return Ok(Variable::from(url.split_once("/?").unwrap().1.to_string()));
     }
 
-    reqwest::Client::builder()
+    let builder = reqwest::Client::builder()
         .user_agent(agent.as_ref())
         .timeout(Duration::from_millis(timeout))
-        .redirect(Policy::none())
+        .redirect(Policy::none());
-        .danger_accept_invalid_certs(true)
+
+    #[cfg(feature = "test_mode")]
+    let builder = builder.danger_accept_invalid_certs(true);
+
+    builder
         .build()
         .map_err(|err| {
             trc::SieveEvent::RuntimeError