# tls_prescan report

files scanned: 9 — findings: 32

## HIGH
- `TLS-VERIFY-OFF` hostile/Config.java:7 — certificate verification explicitly disabled — any TLS peer is accepted; MITM reads and rewrites the channel
- `TLS-VERIFY-OFF` hostile/app.js:5 — certificate verification explicitly disabled — any TLS peer is accepted; MITM reads and rewrites the channel
- `TLS-VERIFY-OFF` hostile/app.js:6 — certificate verification explicitly disabled — any TLS peer is accepted; MITM reads and rewrites the channel
- `TLS-VERIFY-OFF` hostile/app.py:12 — certificate verification explicitly disabled — any TLS peer is accepted; MITM reads and rewrites the channel
- `TLS-VERIFY-OFF` hostile/app.py:21 — peer-auth constant CERT_NONE/VERIFY_NONE bound into a call or attribute — certificate chain unchecked
- `TLS-VERIFY-OFF` hostile/app.py:25 — peer-auth constant CERT_NONE/VERIFY_NONE bound into a call or attribute — certificate chain unchecked
- `TLS-VERIFY-OFF` hostile/app.py:28 — ssl=False on a client/connector line — peer certificates are not authenticated
## MEDIUM
- `TLS-WEAK-VERSION` hostile/Config.java:5 — legacy protocol explicitly selected — SSLv3/TLSv1.x expose downgrade + known-attack surface
- `TLS-HOSTNAME-OFF` hostile/Config.java:12 — hostname/CN check disabled — a valid certificate for ANY domain satisfies the channel (MITM window)
- `TLS-DB-OFF` hostile/Config.java:13 — database connection TLS explicitly off — queries and credentials cross the wire in plaintext
- `TLS-HOSTNAME-OFF` hostile/app.js:7 — hostname/CN check disabled — a valid certificate for ANY domain satisfies the channel (MITM window)
- `TLS-WEAK-VERSION` hostile/app.js:8 — legacy protocol explicitly selected — SSLv3/TLSv1.x expose downgrade + known-attack surface
- `TLS-PLAINTEXT` hostile/app.js:11 — http:// endpoint bound to a transport name/arg — credentials and payloads travel unencrypted
- `TLS-PLAINTEXT` hostile/app.js:12 — http:// endpoint bound to a transport name/arg — credentials and payloads travel unencrypted
- `TLS-PLAINTEXT` hostile/app.py:6 — http:// endpoint bound to a transport name/arg — credentials and payloads travel unencrypted
- `TLS-PLAINTEXT` hostile/app.py:17 — http:// endpoint bound to a transport name/arg — credentials and payloads travel unencrypted
- `TLS-WEAK-VERSION` hostile/app.py:23 — legacy protocol explicitly selected — SSLv3/TLSv1.x expose downgrade + known-attack surface
- `TLS-HOSTNAME-OFF` hostile/app.py:24 — hostname/CN check disabled — a valid certificate for ANY domain satisfies the channel (MITM window)
- `TLS-WEAK-CIPHER` hostile/app.py:26 — cipher suite keeps a broken class (RC4/DES/EXPORT/NULL/MD5 family) — token not negated by '!'
- `TLS-DB-OFF` hostile/app.py:30 — database connection TLS explicitly off — queries and credentials cross the wire in plaintext
- `TLS-PM-BYPASS` hostile/deploy.sh:2 — tooling/package-manager TLS bypass — artifact and credential fetches accept any peer
- `TLS-PM-BYPASS` hostile/deploy.sh:3 — tooling/package-manager TLS bypass — artifact and credential fetches accept any peer
- `TLS-PM-BYPASS` hostile/deploy.sh:4 — tooling/package-manager TLS bypass — artifact and credential fetches accept any peer
- `TLS-PM-BYPASS` hostile/deploy.sh:6 — tooling/package-manager TLS bypass — artifact and credential fetches accept any peer
- `TLS-WEAK-VERSION` hostile/site.nginx:3 — legacy protocol explicitly selected — SSLv3/TLSv1.x expose downgrade + known-attack surface
- `TLS-WEAK-CIPHER` hostile/site.nginx:4 — cipher suite keeps a broken class (RC4/DES/EXPORT/NULL/MD5 family) — token not negated by '!'
- `TLS-CONFIG-SKIP` hostile/site.nginx:5 — config/IaC skip-verify key set — the deployed client stops authenticating its TLS peers
- `TLS-CONFIG-SKIP` hostile/stack.yml:2 — config/IaC skip-verify key set — the deployed client stops authenticating its TLS peers
- `TLS-CONFIG-SKIP` hostile/stack.yml:3 — config/IaC skip-verify key set — the deployed client stops authenticating its TLS peers
- `TLS-PLAINTEXT` hostile/stack.yml:4 — http:// endpoint bound to a transport name/arg — credentials and payloads travel unencrypted
- `TLS-PM-BYPASS` hostile/stack.yml:6 — tooling/package-manager TLS bypass — artifact and credential fetches accept any peer
## LOW
- `TLS-WRAP-NOVERIFY` hostile/legacy.py:6 — legacy wrap_socket/SSLContext defaults to CERT_NONE — peer is never authenticated