rules:
  - id: go-tls-insecure-skip-verify
    pattern-either:
      - pattern: |
          &tls.Config{InsecureSkipVerify: true, ...}
      - pattern: |
          tls.Config{InsecureSkipVerify: true, ...}
    message: >-
      InsecureSkipVerify disables TLS certificate validation entirely.
      This makes connections vulnerable to MITM attacks.
    severity: ERROR
    languages: [go]
    metadata:
      category: security
      cwe:
        - "CWE-295: Improper Certificate Validation"
      quantum_vulnerable: false
      quantum_risk_score: 8

  - id: go-tls-weak-min-version
    pattern-either:
      - pattern: |
          &tls.Config{MinVersion: tls.VersionTLS10, ...}
      - pattern: |
          &tls.Config{MinVersion: tls.VersionTLS11, ...}
      - pattern: |
          &tls.Config{MinVersion: tls.VersionSSL30, ...}
    message: >-
      Weak TLS minimum version detected. TLS 1.0 and 1.1 are deprecated (RFC 8996).
      Use tls.VersionTLS13 for post-quantum cipher suite support.
    severity: ERROR
    languages: [go]
    metadata:
      category: security
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      quantum_vulnerable: true
      quantum_risk_score: 8
