The boost ASIO wrapper in net/asio.cpp in Pichi prior to 1.3.0 lacks TLS hostname verification.
pichi project pichi