Ace needs to use HTTPS for a custom UI extension in local development but encounters CSP errors and insecure content warnings.

Nicholas advises using `PRIVATE_APP_ACCESS_TOKEN` in .env, ensuring scopes in app.json, and avoiding hardcoded localhost. Ace later confirms improvements after setup adjustments.