The bug

The official Cobalt site (playcobalt.com) only supports http.
Not only is this bad for the users, but it will also harm Cobalt since Google is planning to show for http sites that they are not secure (https://blog.chromium.org/2018/02/a-secure-web-is-here-to-stay.html) and already considers it in their search result ranking (https://webmasters.googleblog.com/2014/08/https-as-ranking-signal.html).