TLS certificate verification disabled

HighAV-NET-005NetworkCore pack

What it finds

HTTPS certificate checking is turned off, so the agent will accept any certificate — including an attacker's.

Why it matters

Encryption without certificate checks does not prove who you are talking to. Anyone on the network path can impersonate the API and read or alter the traffic, including credentials.

What an attacker could do: API keys and tool results passing over these connections could be intercepted or forged.

How to fix it

Remove the override and keep certificate verification on. For internal certificates, add your CA to the trust store instead of disabling checks.

Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans

Check details

Finding code: TLS_VERIFICATION_DISABLED
How it detects: Looks for a specific risky pattern in the code or config.
Confidence: Definite: the risky setting is written plainly in the file.
Scans: Any text-based agent source or configuration (JS/TS/Python/JSON/YAML)
OWASP LLM Top 10: LLM06 - Sensitive Information Disclosure, LLM05 - Supply Chain Vulnerabilities
NIST AI RMF: MG-2.2
SOC 2: CC6.7, CC6.1

Check your agent for this

Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.

Scan an agent free Run it in CI or your editor