Breaking change doc: NuGet audit sources no longer allow insecure HTTP by default

docs/core/compatibility/10.md

@@ -139,6 +139,7 @@ See [Breaking changes in EF Core 10](/ef/core/what-is-new/ef-core-10.0/breaking-
 | [PrunePackageReference privatizes direct prunable references](sdk/10.0/prune-packagereference-privateassets.md) | Behavioral change |
 | [HTTP warnings promoted to errors in `dotnet package list` and `dotnet package search`](sdk/10.0/http-warnings-to-errors.md) | Behavioral/source incompatible change |
 | [NUGET_ENABLE_ENHANCED_HTTP_RETRY environment variable removed](sdk/10.0/nuget-enhanced-http-retry-removed.md) | Behavioral change |
+| [NuGet audit sources no longer allow insecure HTTP by default](sdk/10.0/nuget-audit-source-http-disallowed.md) | Behavioral change |
 | [NuGet logs an error for invalid package IDs](sdk/10.0/nuget-packageid-validation.md) | Behavioral change |
 | [`ToolCommandName` not set for non-tool packages](sdk/10.0/toolcommandname-not-set.md) | Source incompatible |
 

docs/core/compatibility/sdk/10.0/nuget-audit-source-http-disallowed.md

@@ -0,0 +1,52 @@
+---
+title: "Breaking change: NuGet audit sources no longer allow insecure HTTP by default"
+description: "Learn about the breaking change in .NET 10 SDK where NuGet raises error NU1302 when an audit source uses an insecure HTTP URL without explicitly allowing insecure connections."
+ms.date: 07/29/2026
+ai-usage: ai-assisted
+---
+
+# NuGet audit sources no longer allow insecure HTTP by default
+
+Starting in .NET 10.0.400 SDK, NuGet raises error NU1302 when an `auditSource` defined in *nuget.config* uses an insecure `http://` URL and doesn't have `allowInsecureConnections="true"` set.
+
+## Version introduced
+
+.NET 10.0.400 SDK
+
+## Previous behavior
+
+Previously, if an `auditSource` used an insecure `http://` URL, NuGetAudit continued without warnings.
+
+## New behavior
+
+Starting in .NET 10.0.400 SDK, NuGet raises error NU1302 when an `auditSource` uses an insecure `http://` URL. The error message instructs you to update the URL to use HTTPS or set `allowInsecureConnections="true"` in your *nuget.config* file.
+
+## Type of breaking change
+
+This change is a [behavioral change](../../categories.md#behavioral-change).
+
+## Reason for change
+
+This change aligns audit sources with the behavior of package sources, which already require HTTPS by default.
+
+## Recommended action
+
+Use audit sources that support HTTPS. For example, update your *nuget.config* to use `https://api.nuget.org/v3/index.json`:
+
+```xml
+<auditSources>
+  <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+</auditSources>
+```
+
+If you can't migrate to HTTPS immediately, set `allowInsecureConnections="true"` on the audit source in your *nuget.config*:
+
+```xml
+<auditSources>
+  <add key="my-audit-source" value="http://my-source/index.json" allowInsecureConnections="true" />
+</auditSources>
+```
+
+## Affected APIs
+
+None.

docs/core/compatibility/toc.yml

@@ -236,6 +236,8 @@ items:
                 href: sdk/10.0/deps-json-trimmed-packages.md
               - name: NUGET_ENABLE_ENHANCED_HTTP_RETRY environment variable removed
                 href: sdk/10.0/nuget-enhanced-http-retry-removed.md
+              - name: NuGet audit sources no longer allow insecure HTTP by default
+                href: sdk/10.0/nuget-audit-source-http-disallowed.md
               - name: NuGet logs an error for invalid package IDs
                 href: sdk/10.0/nuget-packageid-validation.md
               - name: PackageReference without a version raises error