The config editor (config-tool) is accessible only via unsecured http connection (Web Interface and API). The configuration mostly contains sensitive date like credentials for the database, storagebackend and so on.

Quay instances used in highly regulated environments must use TLS to connect to the config editor.