I hate dinging hobby projects, but then it's Bitcoin and people seem to be actually trusting hobby projects with non-trivial fractions of their (extremely notional) net worth, so I'll just point out that transferring a public/private key pair which allows people to spend money together over HTTP is not a security best practice.
I don't think you should feel even a hint of remorse, crypto and money are both very serious things. A project with crypto and money at its center is in my mind basically exempt from any margin for error normally associated with a hobby project.
That's true, but the code that generates the wallet is still sent over HTTP, so there is an opportunity for an attacker to insert malicious code. It would be a lot better if this was served over HTTPS, but then you still need to trust the author.
