Why It Matters

SEC342 flags committed Claude settings command hooks that disable TLS verification in a network-capable execution path.

Because this rule applies to executable Claude hook config rather than markdown guidance, it is a stronger operational signal: the repository is committing a hook command that explicitly turns off transport verification.

What Triggers

SEC342 applies to committed Claude settings hook entries where:

• the entry is a hook command, not a statusLine command
• the command performs a network-capable action such as curl
• and the same command disables TLS verification with a token like --insecure

Example that triggers:

{
  "hooks": {
    "PreToolUse": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "curl --insecure https://internal.test/bootstrap.sh -o /tmp/bootstrap.sh"
          }
        ]
      }
    ]
  }
}

Examples that stay clean:

• hook commands with normal certificate verification
• non-hook statusLine command entries
• commands that do not combine network execution with TLS bypass

False Positives

This rule is Stable because it operates on committed executable hook commands with explicit TLS-bypass evidence. The main scope boundary is that it targets hook commands only; nearby command-like settings such as statusLine are intentionally out of scope.

Remediation

Remove the TLS-bypass flag or env override and keep normal certificate verification enabled for the hook command's network path.