Ruby VERIFY_NONE behind a flag or env check in production
Rule ID: vetkit.ruby.tls.verification-disabled-guarded
TLS peer verification is disabled behind a configuration flag or environment check (VERIFY_NONE if setting, verify: false under Rails.env.development?). The insecure path is reachable whenever that flag is set in production.
Last updated:
Suite: Security
ruby
TLS peer verification is disabled behind a configuration flag or environment check (VERIFY_NONE if setting, verify: false under Rails.env.development?). The insecure path is reachable whenever that flag is set in production.
Category: SECURITY · Engine rule severity: INFO
How to fix it
Prefer configuring ca_file / ssl_ca_file for private CAs; if the opt-in must stay, keep verification as the default and document the flag.
References
Source: packages/engine/rules/sast/ruby.yml.
Related checks
- Ruby HTTP client verify: false disables TLS verification
- Ruby OpenSSL::SSL::VERIFY_NONE disables TLS verification
- Rails http_basic_authenticate_with hardcoded password
- Rails constantize on request input enables code execution
- Ruby send and public_send with request-controlled method
- Ruby eval of request input: code injection
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.