TLS peer verification, where it is disabled and where it is left to the default.
Encryption without authentication is not security. A TLS connection that does not verify the peer's certificate is confidential against a passive observer and wide open to anyone who can answer for the host — which is the threat TLS exists to address. The failure is silent by construction: the connection succeeds, the data is encrypted, and nothing distinguishes a verified session from an unverified one at runtime.
Two shapes, and the second is the reason this is not a grep.
Disabled outright
verify: :verify_none is a literal, so it is exactly detectable — either
as a bare atom or nested inside a literal option list:
{:move, {:literal, [verify: :verify_none]}, {:x, 2}}
{:move, {:atom, :verify_none}, {:x, 2}}Left to the default
A TLS connect whose option list is a literal that never mentions verify
takes whatever the library defaults to. Erlang's :ssl client verified
nothing at all before OTP 26, and many wrappers still pass options through
without supplying one. Reading a call site tells you nothing here — the
absence is the finding, and absence is what a search cannot look for.
Only literal option lists are examined. A list built at runtime is recorded as unknown rather than guessed at, because a false "this is insecure" on a call that configures itself properly is worse than silence.
Emitted facts
tls_verification(id, func, setting)—"none"|"peer"|"absent"tls_connect(id, func, api, opts)— a TLS connect and how its options were supplied:"literal"|"dynamic"