Zennoxa Shield
Rules / Go
SHIELD-GO-008

TLS InsecureSkipVerify enabled

highGoCWE-295CVSS 7.4

What it detects

Setting InsecureSkipVerify: true disables certificate validation, allowing MITM attacks.

How to fix

Never set InsecureSkipVerify to true in production. Fix the TLS certificate instead.

Vulnerable — Shield flags thisclient.go
package api

import (
	"crypto/tls"
	"net/http"
)

func NewClient() *http.Client {
	return &http.Client{
		Transport: &http.Transport{
			// Accepts ANY certificate — enables man-in-the-middle
			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
		},
	}
}
Fixed — scans cleanclient.go
package api

import (
	"crypto/tls"
	"net/http"
)

func NewClient() *http.Client {
	return &http.Client{
		Transport: &http.Transport{
			// Default verification stays on; just pin a modern TLS floor.
			TLSClientConfig: &tls.Config{MinVersion: tls.VersionTLS12},
		},
	}
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-GO-008, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-GO-008: TLS InsecureSkipVerify enabled — Zennoxa Shield