Go modules · proxy.golang.org

github.com/flipt-io/flipt/build

Remote Payload, Tls Verification Disabled, Credential file access

Why PkgRadar flagged v0.0.0-20260718064231-8e84d288749a

Severity	Signal	Evidence
medium	Remote Payload	—
medium	Tls Verification Disabled	—

Showing signal labels only. Sign in to view the exact matched indicators for each finding.

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`v0.0.0-20260718064231-8e84d288749a`	Review	39	2026-07-19
`v0.0.0-20260718011037-2ba78353193a`	Low risk	0	2026-07-19
`v0.0.0-20260717102630-90e6a80f1330`	Review	39	2026-07-18
`v0.0.0-20260716030431-22b82033c0cb`	Low risk	0	2026-07-18
`v0.0.0-20260715225944-555c557b2f81`	Low risk	0	2026-07-17
`v0.0.0-20260715111205-01d8719edf16`	Review	39	2026-07-17
`v0.0.0-20260715225907-46b046307e38`	Low risk	0	2026-07-17
`v0.0.0-20260714082834-eff770faec9e`	Review	39	2026-07-15
`v0.0.0-20260713202534-028f10fa7acb`	Low risk	0	2026-07-15
`v0.0.0-20260713140137-cb9fad6050f4`	Low risk	0	2026-07-14
`v0.0.0-20260713131708-af830342b536`	Low risk	0	2026-07-14
`v0.0.0-20260713125840-99d236930d8a`	Low risk	0	2026-07-14

Block this in CI

PkgRadar gates github.com/flipt-io/flipt/build (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/flipt-io/flipt/[email protected]