tls_verification_disabled

Re-enable certificate verification; trust the internal CA explicitly instead low effort

// Before (VULNERABLE): any MITM can read/modify this traffic
const agent = new https.Agent({ rejectUnauthorized: false });

// After (SAFE): verification stays on; the internal CA is trusted
const agent = new https.Agent({ ca: fs.readFileSync("/etc/ssl/internal-ca.pem") });

# Python equivalent:
# requests.get(url, verify="/etc/ssl/internal-ca.pem")  # not verify=False

Suppress a confirmed non-issue with a committed .pullguardignore entry (pullguard ignore locally, or comment /pullguard ignore <fingerprint> <reason> on the PR — the fingerprint is printed in the PR comment’s Triage section). Entries support expiresAt for time-boxed snoozes.

Security findings at major or critical severity — and any critical finding — always surface: .pullguardignore cannot hide them. The reviewed paths that keep them visible are acknowledged (reviewed, stays in reports) and, for a confirmed false positive, a reasoned false_positive entry — visible and audited, excluded only from the merge block.