mediumEncrypted connections

Certificate Checking Switched Off

The client accepts any certificate, so it cannot tell a real server from an impostor.

Why it matters

verify=False is usually added to get past a certificate error on a laptop or a self-signed internal service. It also removes the only protection against someone sitting between you and the API. Pointing the client at the right CA bundle fixes the error and keeps the check.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

requests with verify=False

resp = requests.get(url, verify=False, timeout=5)

The smallest fix

minimal patch

# Point at the CA that signed the internal certificate instead of disabling checks
resp = requests.get(url, verify="/etc/ssl/certs/internal-ca.pem", timeout=5)
# Or install the CA system-wide and keep the default verify=True

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

safe alternative

# Use certifi (bundled with requests) for public services, and for
# self-signed internal services put the CA in REQUESTS_CA_BUNDLE or
# SSL_CERT_FILE via the environment so no code change is needed.

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

In [the file] at line [the line number] certificate verification is disabled: [the flagged code]. Remove it and, if the target uses an internal CA, pass the CA bundle path via verify= or the REQUESTS_CA_BUNDLE environment variable. Keep verification on in every environment.

How to check the fix worked

1. Call the client against https://expired.badssl.com and confirm it
   raises an SSL error.
2. Call the real endpoint and confirm it still succeeds.