PkgRadar

Go modules · proxy.golang.org

github.com/VMWARE-TANZU/VELERO

Credential file access: matched "GOOGLE_APPLICATION_CREDENTIALS"

Why PkgRadar flagged v0.9.3

SeveritySignalEvidence
mediumCredential file accessmatched "GOOGLE_APPLICATION_CREDENTIALS" · github.com/vmware-tanzu/[email protected]/pkg/cloudprovider/gcp/block_store.go

Scanned versions

VersionVerdictScoreScanned (UTC)
v0.9.3Review252026-06-15
v0.7.0Review52026-06-15
v1.2.6Review372026-06-15
v1.6.0-rc.1Review182026-06-15
v1.9.6Review182026-06-15
v1.5.1Review132026-06-15
v1.2.7Review372026-06-15
v1.9.0-rc.2Review182026-06-15
v1.6.0Review182026-06-15
v1.10.3-rc.1Review182026-06-15
v1.4.2Review132026-06-15
v1.9.3-rc.3Review182026-06-15
v1.9.7Review182026-06-15
v1.17.2Review232026-06-15
v1.0.0Review372026-06-15
v1.14.0Review232026-06-15
v0.8.0Review152026-06-15
v1.9.5-rc.1Review182026-06-15
v0.9.8-beta.1Review252026-06-15
v1.8.1-rc.2Review182026-06-15
v1.18.0Review232026-06-15
v0.9.9Review252026-06-15
v0.9.11Review252026-06-15
v1.10.0-rc.1.0.20260611061524-ea9e7da301d7Review232026-06-15
v1.4.1-0.20200716224906-2376b697afc0Review132026-06-15
v1.18.1Review232026-06-15
v1.12.0Review232026-06-15

Block this in CI

PkgRadar gates github.com/VMWARE-TANZU/VELERO (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/VMWARE-TANZU/[email protected]
Start free — 25 scans / moView full evidence