TLS verification disabled
Part of the AI-generated code risks check · fix arrives as a pull request
What it is
TLS certificate verification is switched off — rejectUnauthorized: false, NODE_TLS_REJECT_UNAUTHORIZED=0, verify=False, or an equivalent — on a path that runs outside local development.
Why it matters
Verification is what makes TLS mean anything. Without it the connection is still encrypted but to whoever answered, so any network position between you and the service can read and rewrite the traffic.
How to fix it
Turn verification back on. If the endpoint uses an internal CA, add that CA to the trust store or pass it as ca rather than disabling the check. Scope any remaining exception to local development by environment, never by default.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.