TLS that encrypts without authenticating.
A TLS connection that does not verify the peer's certificate is confidential against a passive observer and wide open to anyone who can answer for the host — which is the threat TLS exists to address. Nothing distinguishes a verified session from an unverified one at runtime: the connection succeeds, the bytes are encrypted, and the padlock is a lie.
Two shapes, and the second is why this is an analysis rather than a
search. verify: :verify_none is a literal someone wrote and can be
grepped. An option list that never mentions verify at all takes whatever
the library defaults to — and Erlang's :ssl client verified nothing
before OTP 26. Reading that call site tells you nothing, because the
absence is the finding, and absence is what a search cannot look for.