Design/Logic Flaw

Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs...