194
TLS
Encryption and identity on the wire. HTTPS is HTTP inside TLS. Turning off verification is not a dev mode to ship.
What is TLS?
TLS authenticates the server (the certificate) and encrypts the session. Clients must verify the certificate. `rejectUnauthorized: false` accepts any impostor. Certificates expire. Private keys are secrets.
Why does TLS matter when vibe coding?
Models disable TLS verification to silence a local error, and the setting ships. Name verification as part of the connection.
How do you do TLS?
HTTPS everywhere outside localhost. Verify certificates. Pin only if you have a rotation story. Do not commit private keys. Renew before expiry.
How do you ask a model for TLS?
Serve (endpoint) over TLS. Verify certificates. Do not disable certificate checks. Do not commit private keys. Do not follow a tutorial that sets rejectUnauthorized false.
What goes wrong with TLS?
Terminating TLS at a proxy and speaking cleartext on a network you do not actually trust. Know where encryption stops.