PkgRadar

Go modules · proxy.golang.org

github.com/akuity/Kargo

Remote Payload: matched "api.github.com/graphql"

Why PkgRadar flagged v1.10.0-rc.1.0.20260529183739-edc4a3ccc052

SeveritySignalEvidence
mediumRemote Payloadmatched "api.github.com/graphql" · github.com/akuity/[email protected]/pkg/governance/github_client.go
mediumCredential file accessmatched "id_rsa" · github.com/akuity/[email protected]/pkg/controller/git/base_repo.go

Scanned versions

VersionVerdictScoreScanned (UTC)
v1.10.0-rc.1.0.20260529183739-edc4a3ccc052Review222026-06-01
v0.1.0-rc.3Review102026-06-01
v0.1.0-rc.1Review102026-06-01
v0.1.0-rc.2Review102026-06-01

Block this in CI

PkgRadar gates github.com/akuity/Kargo (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/akuity/[email protected]