Disabled TLS Validation (ARCH8119)

Key kotlin.security.disabled-tls-validation · Severity error · Category security · CWE CWE-295

Flags trust-all X509TrustManager implementations and HostnameVerifier { _, _ -> true }.

Incorrect

object : X509TrustManager {
    override fun checkServerTrusted(chain: Array<X509Certificate>, authType: String) {}
}

Correct

// keep the platform trust manager; pin or add the internal CA to the trust store

Fix

Trust the internal CA in the trust store instead of disabling validation.