To be fair, the script is "http://localhost:35729/livereload.js". That shouldn't leak anything to an adversary, if the request doesn't leave the client's computer.
Still should be fixed though, so the HTTPS warning can serve its function and call out real threats.
Still should be fixed though, so the HTTPS warning can serve its function and call out real threats.