github.com certificate validation

would it make sense, before calling endpoints of the github.com api (and before sending secret accesstokens over the wire) to validate the ssl certificate of the endpoint, so we are sure we are actually sending the secret data over to github.com and not another system which pretends to be github.com?

as far as I understand the current code, the certificate is not validated right now?

if I read guzzle docs corretcly it should be possible to pass the github.com cert to verify so we can be sure about the other end of the TLS encryption: https://www.bookstack.cn/read/guzzlephp-7.0-en/spilt.28.239bab766e46db73.md

in case this is considered out-of-scope, because this package abstracts a away the http-client beeing used behind http-plug, it might be worthwhile to describe in https://github.com/KnpLabs/php-github-api/blob/master/doc/security.md how to validate the cert properly.

Esamina come viene configurato il client HTTP prima che vengano chiamati gli endpoint di GitHub API e rivedi doc/security.md. Verifica se la verifica dei certificati è già abilitata tramite l’astrazione del client HTTP, quindi determina se il risultato debba essere una configurazione del client o una documentazione sulla sicurezza; il lavoro è completato quando l’approccio scelto verifica chiaramente l’endpoint GitHub prima dell’invio dei token segreti.