I was working on a company's staging server today when I noticed that they are hosting their API's subdomain over an HTTPS connection while they are serving their user-facing dashboard over an HTTP connection. Does this pose a security risk? I know that HTTP provides no protection to data transmitted over the network, but I don't know if this will affect any HTTPS calls that are made after the page has loaded in a user's browser.
Also, a few notes: The company's dashboard is a single page application. I inspected the network traffic going on when you load the page and as far as I can tell all AJAX requests are being sent over HTTPS, including requests for logging in.
If this is a security risk, can you point me towards some official documents that I can use to persuade the company that they have an issue?