TRUST_SECURE_PAYMENT_CONTEXT
Credentials or card details posted over plain HTTP can be read in transit. That is a direct PCI-DSS and data-protection failure, not a best-practice note.
Impact is importance multiplied by the confidence tier’s weight — SPECIFICATION 1.0, RESEARCH 0.7, EMERGING 0.3, EXPERIMENTAL 0.1. Two rules backed by the same class of evidence therefore always carry the same weight, which is what makes the score reproducible rather than hand-tuned.