no-electron-insecure-certificate-verify-proc

Disallow Electron certificate verification callbacks that trust invalid certificates.

Targeted pattern scope

Electron session.setCertificateVerifyProc handlers that trust invalid certificates.

What this rule reports

Verify-proc handlers that callback(0) or return 0.

Why this rule exists

Overriding certificate checks can silently disable TLS trust guarantees.

❌ Incorrect

session.defaultSession.setCertificateVerifyProc((request, callback) => {
 callback(0);
});

✅ Correct

session.defaultSession.setCertificateVerifyProc((request, callback) => {
 callback(-3);
});

ESLint flat config example

import sdl from "eslint-plugin-sdl-2";

export default [
 {
  plugins: { sdl },

  rules: {
   "sdl/no-electron-insecure-certificate-verify-proc": "error",
  },
 },
];

When not to use it

Disable only if certificate trust is enforced through a reviewed pinning or enterprise policy outside the callback return value.

Package documentation

Rule source

Targeted pattern scope​

What this rule reports​

Why this rule exists​

❌ Incorrect​

✅ Correct​

ESLint flat config example​

When not to use it​

Package documentation​

Further reading​