If you type developer.athom.com in a browser and login to developer environment of your homey you end up on a http site instead of https. To use https you explicitly need to type https… this is not safe, after logging in on developer site one should end up on https by default.
Ok. And what should/could we do about it? Maybe better report this to Athom support.
I will report this to Athom. This post is ment as a warning