PHP TLS verification disabled behind local env check
Rule ID: vetkit.php.tls.verification-disabled-guarded
TLS certificate verification is disabled behind an environment or opt-in check (App::environment('local'), app()->isLocal(), a debug flag). The insecure path is reachable whenever that condition holds in production.
Last updated:
Suite: Security
php
TLS certificate verification is disabled behind an environment or opt-in check (App::environment('local'), app()->isLocal(), a debug flag). The insecure path is reachable whenever that condition holds in production.
Category: SECURITY · Engine rule severity: INFO
How to fix it
Prefer pointing the client at the local CA bundle (cafile / verify => '/path/ca.pem'); if the opt-out must stay, keep it tied to a non-production environment check.
References
Source: packages/engine/rules/sast/php.yml.
Related checks
- PHP cURL TLS verification disabled (CURLOPT_SSL_VERIFYPEER)
- PHP HTTP client TLS certificate verification disabled
- PHP loose == hash comparison: type juggling auth bypass
- PHP strcmp() == 0 on request input allows auth bypass
- PHP unsafe reflection: class or method from request input
- PHP code injection: function name from request input
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.