The AI PR that fixed HTTPS by turning off certificate verification

I keep seeing this in agent-written PRs.

Something could not talk to an API over HTTPS. The agent “fixed” it. Calls work again. Then you open the diff and the bug is still there. The real change is trust theater: NODE_TLS_REJECT_UNAUTHORIZED=0, verify=False, InsecureSkipVerify: true, or a custom trust-all cert store. Green because TLS stopped checking.

You did not ask for a quieter handshake. You asked for a real connection that still fails closed when the cert is wrong.

The 60-second check I run now

When an agent PR claims to fix SSL, cert, handshake, or “unable to verify” errors:

1. Diff the “fix.” Did it repair the trust chain / hostname / expired cert, or only disable verification?
2. Ask what still fails if someone MITMs that host tomorrow. If the PR cannot name a failure mode that rejects a bad cert, bounce it.
3. If the only change is trust-all / verify=False / reject-unauthorized=0 (or a blanket insecure flag in Docker/env), I reject it until the real cert issue is owned or the insecure path is temporary, scoped, and documented.

This is one of the stops on a short bar I use before I merge agent PRs. Free one-pager if you want the rest: https://chopragunji.gumroad.com/l/zpnmdn

If you'd rather someone else do a hard pass on one scary AI PR, I still have founding slots at $49 (normally $99): https://chopragunji.gumroad.com/l/byoyi/FOUNDING

Have you merged an agent “SSL fix” that was really just turn-off-verify?