Using AutoAddPolicy or WarningPolicy
We detected a Paramiko host key policy that implicitly trusts server's host key. Do not use `AutoAddPolicy` or `WarningPolicy` as a missing host key policy when creating `SSHClient`. Unverified host keys can allow a malicious server to take control of a trusted server by using the sensitive data (such as authentication information). Instead, use `RejectPolicy` or a custom subclass.
def do_not_auto_add_or_warning_missing_hostkey_policy_noncompliant():
    from paramiko import AutoAddPolicy
    from paramiko.client import SSHClient
    ssh_client = SSHClient()
    # Noncompliant: Insecure `AutoAddPolicy` is used as missing hostkey policy.
    ssh_client.set_missing_host_key_policy(policy=AutoAddPolicy)
def do_not_auto_add_or_warning_missing_hostkey_policy_compliant():
    from paramiko import RejectPolicy
    from paramiko.client import SSHClient
    ssh_client = SSHClient()
    # Compliant: Secure `RejectPolicy` is used as missing hostkey policy.
    ssh_client.set_missing_host_key_policy(RejectPolicy)