auditing-tls-and-certificate-validationlisted

# Auditing TLS and certificate validation: when the client accepts a certificate it should reject Transport security fails closed by default, so almost every real finding here is code that went out of its way to weaken it. A client that turns verification off, installs a trust manager that approves any chain, skips the hostname check, or swallows an expired-certificate error will complete a handshake against an attacker's certificate and hand plaintext to whoever sits on the network path. This is not about which cipher or protocol version is chosen, that is a different audit; it is about whether the client accepts a certificate it should have rejected. You audit it by finding every outbound TLS client and asking, for each, whether verification, hostname matching, and any required pinning are enforced and fail closed on the reachable production path. The discipline is separating a genuine production bypass from a test-only flag pointed at localhost. ## When to use - Code opens an outbound TLS connection, or configures an HTTP, gRPC, database, or raw socket client. - You see a verification flag, a custom trust manager, a hostname verifier, or a pinning routine. - You want to know whether the client would accept a forged certificate from a network attacker. ## Scope check Test interception only against endpoints and clients you own or are authorized to assess, and stand up any man-in-the-middle only on a network in scope, intercepting a real connection captures live credent