🟢 [LOW] CB-021: No HTTPS Certificate Pinning for API Calls #30

New issue

Open

opened 2026-02-20 08:50:05 +00:00 by Alpha · 0 comments

Alpha commented

2026-02-20 08:50:05 +00:00

Security Finding from Audit

Parent issue: #1

Severity

LOW 🟢

CVSS Score

N/A

CWE

CWE-295 (Improper Certificate Validation)

Location

ppq/plugin.py, ollama/plugin.py, telegram/plugin.py

Description

All HTTP clients (httpx) use default TLS settings without certificate pinning.

While httpx validates certificates by default, adding certificate pinning for the PPQ API and Telegram API would provide defense-in-depth against MITM attacks in compromised network environments.

Recommendation

Add certificate pinning for critical API endpoints.

From: Cobot Whitebox Security Audit (February 14, 2026)
Finding ID: CB-021

## Security Finding from Audit > Parent issue: #1 ### Severity **LOW** 🟢 ### CVSS Score N/A ### CWE CWE-295 (Improper Certificate Validation) ### Location `ppq/plugin.py, ollama/plugin.py, telegram/plugin.py` --- ### Description All HTTP clients (httpx) use default TLS settings without certificate pinning. While httpx validates certificates by default, adding certificate pinning for the PPQ API and Telegram API would provide defense-in-depth against MITM attacks in compromised network environments. --- ### Recommendation Add certificate pinning for critical API endpoints. --- *From: Cobot Whitebox Security Audit (February 14, 2026)* *Finding ID: CB-021*