fix(security): enable TLS certificate verification by default

- Changed verify=False to settings.ssl_verify (default True) across 7 files
- Added ssl_verify config option to Settings
- All HTTP clients now verify TLS certificates by default
- MILESTONE: closes critical MITM vulnerability

Author: bot

bugfinder/agents/api/discover.py

@@ -5,6 +5,7 @@
 import httpx
 
 from bugfinder.agents.base import AgentResult, BaseAgent
+from bugfinder.core.config import settings
 
 API_PATTERNS = [
     "/api",
@@ -47,7 +48,7 @@ async def execute(self) -> AgentResult:
         findings = []
         assets = []
 
-        async with httpx.AsyncClient(timeout=30, follow_redirects=True, verify=False) as client:
+        async with httpx.AsyncClient(timeout=settings.request_timeout, follow_redirects=True, verify=settings.ssl_verify) as client:
             for path in API_PATTERNS:
                 url = urljoin(base_url, path)
                 parsed = urlparse(url)

bugfinder/agents/recon/tech.py

@@ -3,6 +3,7 @@
 import httpx
 
 from bugfinder.agents.base import AgentResult, BaseAgent
+from bugfinder.core.config import settings
 
 TECH_SIGNATURES: dict[str, list[str]] = {
     "nginx": ["nginx", "nginx/"],
@@ -39,7 +40,7 @@ async def execute(self) -> AgentResult:
         findings = []
 
         try:
-            async with httpx.AsyncClient(timeout=30, follow_redirects=True, verify=False) as client:
+            async with httpx.AsyncClient(timeout=settings.request_timeout, follow_redirects=True, verify=settings.ssl_verify) as client:
                 response = await client.get(url, headers=headers)
                 body = response.text.lower()
                 raw_headers = dict(response.headers)

bugfinder/agents/secrets/scan.py

@@ -5,6 +5,7 @@
 import httpx
 
 from bugfinder.agents.base import AgentResult, BaseAgent
+from bugfinder.core.config import settings
 from bugfinder.utils.crypto import detect_high_entropy_strings
 
 SECRET_PATTERNS: list[tuple[str, str, str]] = [
@@ -35,7 +36,7 @@ async def execute(self) -> AgentResult:
 
         targets_to_scan = [base_url]
 
-        async with httpx.AsyncClient(timeout=30, follow_redirects=True, verify=False) as client:
+        async with httpx.AsyncClient(timeout=settings.request_timeout, follow_redirects=True, verify=settings.ssl_verify) as client:
             js_paths = ["/", "/static/js/", "/assets/", "/app.js", "/main.js"]
             for path in js_paths:
                 from urllib.parse import urljoin

bugfinder/agents/web/crawler.py

@@ -5,6 +5,7 @@
 import httpx
 
 from bugfinder.agents.base import AgentResult, BaseAgent
+from bugfinder.core.config import settings
 
 COMMON_PATHS = [
     "/robots.txt",
@@ -46,7 +47,7 @@ async def execute(self) -> AgentResult:
         findings = []
         assets = []
 
-        async with httpx.AsyncClient(timeout=30, follow_redirects=True, verify=False) as client:
+        async with httpx.AsyncClient(timeout=settings.request_timeout, follow_redirects=True, verify=settings.ssl_verify) as client:
             try:
                 resp = await client.get(base_url, headers=headers)
                 assets.append(

bugfinder/agents/web/sqli.py

@@ -3,6 +3,7 @@
 import httpx
 
 from bugfinder.agents.base import AgentResult, BaseAgent
+from bugfinder.core.config import settings
 
 SQLI_PAYLOADS = ["'", '"', "1=1--", "' OR '1'='1", '" OR "1"="1', "1 UNION SELECT 1"]
 
@@ -34,7 +35,7 @@ async def execute(self) -> AgentResult:
         findings = []
         headers = {"User-Agent": "BugFinder/0.1.0"}
 
-        async with httpx.AsyncClient(timeout=30, follow_redirects=True, verify=False) as client:
+        async with httpx.AsyncClient(timeout=settings.request_timeout, follow_redirects=True, verify=settings.ssl_verify) as client:
             try:
                 resp = await client.get(base_url, headers=headers)
             except Exception:

bugfinder/agents/web/xss.py

@@ -5,6 +5,7 @@
 import httpx
 
 from bugfinder.agents.base import AgentResult, BaseAgent
+from bugfinder.core.config import settings
 
 XSS_PAYLOADS = [
     "<script>alert(1)</script>",
@@ -27,7 +28,7 @@ async def execute(self) -> AgentResult:
         findings = []
         headers = {"User-Agent": "BugFinder/0.1.0"}
 
-        async with httpx.AsyncClient(timeout=30, follow_redirects=True, verify=False) as client:
+        async with httpx.AsyncClient(timeout=settings.request_timeout, follow_redirects=True, verify=settings.ssl_verify) as client:
             try:
                 resp = await client.get(base_url, headers=headers)
                 content = resp.text.lower()

bugfinder/core/config.py

@@ -53,7 +53,8 @@ class Settings(BaseSettings):
         default=str(Path(user_data_dir(APP_NAME, ensure_exists=True)) / "cache"),
     )
 
-    # Scope
+    # Security
+    ssl_verify: bool = Field(default=True, description="Verify TLS certificates")
     scope_enforcement: bool = Field(default=True)
     allowed_domains: list[str] = Field(default=[], description="Allowed domains for testing")
 

bugfinder/utils/http.py

@@ -29,7 +29,7 @@ async def request(
     async with httpx.AsyncClient(
         timeout=httpx.Timeout(settings.request_timeout),
         follow_redirects=True,
-        verify=False,
+        verify=settings.ssl_verify,
     ) as client:
         response = await client.request(method, url, headers=headers, **kwargs)
         return response