# SSL/TLS Certificate Verification Disabled

- ID: python-ssl-verification-disabled
- Severity: HIGH
- CWE: Improper Certificate Validation (CWE-295)
- Languages: Python

## Description

Detects disabled SSL/TLS certificate verification in HTTP requests. This makes
the application vulnerable to man-in-the-middle (MITM) attacks where attackers
can intercept and modify encrypted traffic. Always verify SSL certificates.

## Remediation

Keep SSL verification enabled (verify=True is the default).

```python
import requests

response = requests.get(url, verify=True, timeout=10)

# For custom CA certificates:
response = requests.get(url, verify='/path/to/ca-bundle.crt')
```

Learn more: https://shoulder.dev/learn/python/cwe-295/ssl-verification-disabled

## Documentation

[object Object]

## Related Rules

- **Insecure TLS/SSL Configuration** [HIGH]: 
- **Insecure TLS/SSL Configuration** [HIGH]: 
- **SSL/TLS Certificate Validation Disabled** [HIGH]: