github.com certificate validation

would it make sense, before calling endpoints of the github.com api (and before sending secret accesstokens over the wire) to validate the ssl certificate of the endpoint, so we are sure we are actually sending the secret data over to github.com and not another system which pretends to be github.com?

as far as I understand the current code, the certificate is not validated right now?

if I read guzzle docs corretcly it should be possible to pass the github.com cert to `verify` so we can be sure about the other end of the TLS encryption: https://www.bookstack.cn/read/guzzlephp-7.0-en/spilt.28.239bab766e46db73.md

in case this is considered out-of-scope, because this package abstracts a away the http-client beeing used behind http-plug, it might be worthwhile to describe in https://github.com/KnpLabs/php-github-api/blob/master/doc/security.md how to validate the cert properly.

Inspect how the HTTP client is configured before GitHub API endpoints are called, and review doc/security.md. Check whether certificate verification is already enabled through the HTTP client abstraction, then determine whether the result should be client configuration or security documentation; done means the chosen approach clearly verifies the GitHub endpoint before secret tokens are sent.

Escrito por el modelo de indexación a partir del texto del issue.