sshconfig-lint

Insecure SSH option

warningChecked in the browserINSECURE_OPT

A setting weakens host verification or enables risky forwarding too broadly.

Why it matters

Disabled verification enables man-in-the-middle attacks. Broad forwarding exposes local capabilities to every matching server.

How to fix it

Remove StrictHostKeyChecking no, or use accept-new when first-use automation is required while still rejecting changed keys. Keep ForwardAgent and X11 forwarding off globally and enable them only inside a specific trusted Host block.

Before and after

What is wrong

Host *  StrictHostKeyChecking no  ForwardAgent yes

Corrected configuration

Host github.com  StrictHostKeyChecking accept-new  ForwardAgent no