TLS validation disabled (ARCH2119)

Key python.security.disabled-tls-validation · Severity error · Category security · CWE CWE-295

Unconditionally bypassing TLS certificate or hostname validation defeats the authentication guarantee of TLS. This enables man-in-the-middle attacks and silent eavesdropping on traffic.

Incorrect

import requests

resp = requests.get("https://api.example.com/data", verify=False)

Correct

import requests

resp = requests.get("https://api.example.com/data", verify=True)
# For a private CA: verify="/etc/ssl/certs/internal-ca.pem"

Fix

Keep certificate validation enabled; for a private CA, pass the CA bundle to verify.