NPR website is broken
Although the NPR website does have a HTTPS landing page, it will direct you back to the HTTP version. It also has an incorrect certificate, making it doubly useless.
This is the response I received from NPR:
We appreciate you sharing your concerns. NPR.org does not support HTTPS Everywhere and our site does not use https protocol. We do offer secure login for NPR.org accounts, however we use secure.npr.org for login activities.
Therefore, I suggest removal of the NPR ruleset.
Trac:
Username: ntkoopman
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information