How to avoid 'Potential Security Issue' if users incorrectly use www for an appspot.com domain?

I have set up a static one page site on Google App Engine - standard environment - api_version: go1.

If a naive user incorrectly types www in the URL, https://www.givebackourbusses.appspot.com they get a scary warning in Firefox:

'Did Not Connect: Potential Security Issue'

I will not be using a custom domain for this site and would prefer to keep things static by modifying the app.yaml file.

This is my current app.yaml file:

runtime: go
api_version: go1

handlers:

- url: /favicon\.ico
  static_files: static/favicon.ico
  upload: static/favicon\.ico

- url: /
  static_files: static/index.html
  upload: static/index.html
  secure: always

- url: /static
  static_dir: static
  secure: always

# Everything not caught by the above goes to the app's Go code.
- url: /.*
  script: _go_app
  secure: always

How do I modify the app.yaml file to direct a request for www.givebackourbusses.appspot.com to https://givebackourbusses.appspot.com?

Solution

App Engine default certificates covers *.appspot.com, but not ..appspot.com.

As such, accessing it with https://project.appspot.com/ works as expected, but https://www.project.appspot.com does not returns a warning.

The only workaround will be using a custom certificate.