TLS certificate checks turned off
Gaphigh severity · reads .ts .tsx .js .jsx .mjs .cjs .py .envBeta
With checks off, anyone on the network path can read or change the traffic. When Lintsure finds this, it marks it as a Gap: the code itself shows the problem.
What it looks like
A line Lintsure flags in its own test app:
// src/more.ts
const agent = new (require("https").Agent)({ rejectUnauthorized: false });How to fix it
Remove the override and trust a proper certificate. For self-signed certs in tests, scope it to the test only.
Through a coding agent, Lintsure suggests the change and waits. Nothing is edited until you approve it.
Controls it relates to
What the framework asks
GDPR Art. 32: Security of processing
Protect personal data with security that fits the risk: encryption, access control, testing and the ability to recover.
Evidence a reviewer may ask for: Security measures and when they were last tested.
SOC 2 CC6.7: Data in transit
Data moving between systems is protected, usually with properly verified TLS.
Evidence a reviewer may ask for: TLS settings and certificate checks.
ISO 27001 A.8.20: Network security
Networks and connections are protected and controlled.
Evidence a reviewer may ask for: Network and TLS settings.
Summaries are our own reading of the public texts, not the official wording.
Read more: Which SOC 2 controls you can check in code
Check your code for this
Runs on your machine. Your code is never uploaded.
npx lintsure scanThis rule is in Beta: its mapping to framework controls is waiting for review by a qualified compliance professional. Lintsure is a readiness tool, not an audit or legal advice. A finding, or the lack of one, doesn't make you compliant. Disclaimer