# Certificate checks turned off: `verify=False`, `rejectUnauthorized: false`, `InsecureSkipVerify: true`

*Shortcuts that trade away safety*: one of the ways AI coding agents bloat software, from lessloc's [pattern catalog](https://lessloc.org/patterns/index.md). lessloc catches it as [`unsafe`](https://lessloc.org/guide/reference.md#tier-1).

## What makes certificate checks turned off a bad practice?

The standard that calls it a bad practice: [CWE-295](https://cwe.mitre.org/data/definitions/295.html) Improper Certificate Validation.

## What does lessloc do about certificate checks turned off?

lessloc catches it as [`unsafe`](https://lessloc.org/guide/reference.md#tier-1).

- `unsafe` (tier 1): A shortcut that trades away safety: SQL built from values, HTML built or escaped by hand, `Math.random()` for secrets, a fast hash for passwords, certificate checks turned off, text run as code.

## Examples

Caught as `unsafe`:

```python [cn.py]
import requests


def get(u):
    return requests.get(u, verify=False)
```

Written well:

```python [cn.py]
import requests


def get(u):
    return requests.get(u, timeout=10)
```

## Related patterns

Hand-written versions of what the platform does safely. They are short, which is why agents reach for them. The other patterns in [Shortcuts that trade away safety](https://lessloc.org/patterns/index.md#shortcuts-that-trade-away-safety):

- [SQL built from values instead of query parameters](https://lessloc.org/patterns/sql-from-values.md): lessloc catches it as `unsafe`: pass values as query parameters.
- [HTML built or escaped by hand](https://lessloc.org/patterns/html-by-hand.md): lessloc catches it as `unsafe`: use `textContent` or the framework's rendering.
- [Math.random() or random for tokens and passwords](https://lessloc.org/patterns/weak-randomness.md): lessloc catches it as `unsafe`: `crypto.randomUUID()`, `getRandomValues()` or the `secrets` module.
- [Fast hashes (MD5, SHA-1, SHA-256) for passwords](https://lessloc.org/patterns/password-hash.md): lessloc catches it as `unsafe`: bcrypt, scrypt or argon2.
- [Running text as code: eval, exec, new Function](https://lessloc.org/patterns/eval.md): lessloc catches it as `unsafe`: parse the input instead.