[P1] Audit: HTTP Request Builder does not clearly distinguish generate code from send request

[baixiangcpp]

Imported from the byteflow.tools deep audit on 2026-06-22.

Problem: HTTP Request Builder builds request snippets for cURL, fetch, and Python. The UI title and form resemble a request client, so users may expect a Send action. The page should more explicitly state that it generates code and does not send network requests.

Affected URL:

• https://byteflow.tools/en/http-request-builder

Reproduction steps:

1. Open HTTP Request Builder.
2. Configure method, URL, headers, and body.
3. Look for Send/Run behavior.
4. Observe generated cURL/fetch/Python output.
5. Check whether the local-only trust badge and page copy make network behavior unmistakable.

Expected behavior: users should know before entering data that the tool only generates request code and does not send the request.

Actual behavior: the tool is technically browser-local, but the distinction is not prominent enough in the workspace.

Impact: users may be confused by the absence of a Send button or incorrectly assume a request has been executed.

Proposed fix:

• Add subtitle text: “Generate request code only. This tool does not send HTTP requests.”
• Rename primary output section to “Generated request code.”
• Add a non-dismissible local-only note near the URL input.
• Add FAQ entry explaining why no request is sent.
• If a Send feature is ever added, separate it clearly as external request.

Acceptance criteria:

• Above-the-fold UI explicitly says no request is sent.
• Network panel remains quiet when editing/generating code.
• Generated code retains method, URL, headers, query, body, auth, and content type.
• Users can copy code for cURL, fetch, and Python without ambiguity.

[baixiangcpp]

Closed as completed by the canonical BF audit backlog work. This older non-BF audit issue duplicates work now merged through PRs #209-#219, with the BF issues closed and guard/test coverage in place. The remaining non-duplicate follow-up is #7, which stays open because the upstream Next/PostCSS advisory is not fixed yet.