# Detects TLS certificate verification disabled
# Corpus claim: cache/tls/certificate_validation required true
# Pattern: verify_tls: false or verify_tls = false
#
# Violation: Config has verify_tls: false
# Correct: Config has verify_tls: true
#
# Consequence: MITM attacks can intercept cache traffic, steal credentials

[[extractors.declarative]]
name = "tls_verification_disabled"
description = "Detects verify_tls: false in cache config (enables MITM attacks)"
languages = ["rust"]
pattern = 'verify_tls:\s*false'
claim.subject = "tls/certificate_validation"
claim.predicate = "required"
claim.value = false
confidence = 0.95
