[BUG] Hashview HTTPS verification bypasses TLS

Problem

The HashviewAPI class disables SSL/TLS certificate verification when making HTTP requests:

# hate_crack/api.py (around line 1584)
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
self.session.verify = False

This means man-in-the-middle attacks against the Hashview connection are silently accepted, and there is no way for operators to enable proper TLS validation.

Location

• File: hate_crack/api.py
• Lines: ~1257, ~1515 (HashviewAPI.init), ~1584 (urllib3.disable_warnings)
• Class: HashviewAPI

Impact

• Allows attackers to intercept API credentials and responses
• The session.verify = False makes all requests vulnerable to MITM

Recommendation

If Hashview is accessed externally, TLS verification should be enforced. If this is only for local/docker usage, should be:

1. Documented in code comments
2. Made opt-in via config/env flag
3. Or use --insecure-style flags with clear warnings upon disabling

Related

This mirrors the pattern where HashcatRosetta submodule import errors are preserved (not silently discarded), consistency in error handling is preferred.

Start in hate_crack/api.py at HashviewAPI.init and the request setup around lines 1257, 1515, and 1584. Trace how Hashview connections are configured, then ensure certificate verification is enforced by default and that any insecure option is explicit and clearly warned about; the existing Hashview behavior should no longer silently accept MITM connections.