Go modules · proxy.golang.org

github.com/actions/actions-runner-controller

Shipped Live Secret

Why PkgRadar flagged v0.27.7-0.20260627163032-24686a974e47

Severity	Signal	Evidence
high	Shipped Live Secret	—

Showing signal labels only. Sign in to view the exact matched indicators for each finding.

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`v0.27.7-0.20240319115049-48706584fd89`	Low risk	0	2026-08-13
`v0.27.7-0.20260721135106-a035c5a393bd`	Low risk	0	2026-07-22
`v0.0.0-20260303000240-396ee88f5a01`	Low risk	0	2026-07-19
`v0.27.7-0.20260715124409-252eb5176646`	Low risk	0	2026-07-16
`v0.27.7-0.20260714173413-03463c051cc4`	Low risk	0	2026-07-15
`v0.27.7-0.20260710103440-368e2f28b81d`	Low risk	0	2026-07-11
`v0.27.7-0.20260709122246-68c0a8618850`	Low risk	0	2026-07-10
`v0.27.7-0.20260706222857-e06294f5dea7`	Low risk	0	2026-07-07
`v0.27.7-0.20260630130558-2ee6b3b8e8d2`	Low risk	0	2026-07-04
`v0.27.7-0.20260627163032-24686a974e47`	High risk	0	2026-06-28
`v0.27.7-0.20260619110817-c7005c3696e3`	Low risk	0	2026-06-20
`v0.27.7-0.20260615105113-9c5051416023`	Low risk

Block this in CI

PkgRadar gates github.com/actions/actions-runner-controller (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/actions/[email protected]