Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
Nothing found by this check. ✓
Packages you depend on that have known security holes (CVEs).
CVE-2021-43565 golang.org/x/crypto: empty plaintext packet causes panicCVE-2022-27191 golang: crash in a golang.org/x/crypto/ssh serverCVE-2024-45337 golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/cryptoCVE-2025-22869 golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/sshCVE-2025-47913 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESSCVE-2026-39828 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissionsCVE-2026-39829 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parametersCVE-2026-39830 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responsesCVE-2026-39831 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence checkCVE-2026-39832 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictionsCVE-2026-39835 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificateCVE-2026-42508 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKeyCVE-2026-46595 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validationCVE-2026-46597 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputsCVE-2023-48795 ssh: Prefix truncation attack on Binary Packet Protocol (BPP)CVE-2025-47914 golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messagesCVE-2025-58181 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authenticationCVE-2026-39827 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openingsCVE-2026-39833 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmationCVE-2026-39834 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel writeCVE-2026-46598 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed inputCVE-2021-44716 golang: net/http: limit growth of header canonicalization cacheCVE-2022-27664 golang: net/http: handle server errors after sending GOAWAYCVE-2022-41723 golang.org/x/net/http2: avoid quadratic complexity in HPACK decodingCVE-2023-39325 golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)Your dependencies cross-checked against the OSV vulnerability database.
GO-2022-0493 Incorrect privilege reporting in syscall and golang.org/x/sys/unixGO-2025-3503 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/netGO-2025-3563 Request smuggling due to acceptance of invalid chunked data in net/httpGO-2025-3749 Usage of ExtKeyUsageAny disables policy validation in crypto/x509GO-2025-3750 Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscallGO-2025-3751 Sensitive headers not cleared on cross-origin redirect in net/httpGO-2025-3849 Incorrect results returned from Rows.Scan in database/sqlGO-2025-3956 Unexpected paths returned from LookPath in os/execGO-2025-4006 Excessive CPU consumption in ParseAddress in net/mailGO-2025-4007 Quadratic complexity when checking name constraints in crypto/x509GO-2025-4008 ALPN negotiation error contains attacker controlled information in crypto/tlsGO-2025-4009 Quadratic complexity when parsing some invalid inputs in encoding/pemGO-2025-4010 Insufficient validation of bracketed IPv6 hostnames in net/urlGO-2025-4011 Parsing DER payload can cause memory exhaustion in encoding/asn1GO-2025-4012 Lack of limit when parsing cookies can cause memory exhaustion in net/httpGO-2025-4013 Panic when validating certificates with DSA public keys in crypto/x509GO-2025-4014 Unbounded allocation when parsing GNU sparse map in archive/tarGO-2025-4015 Excessive CPU consumption in Reader.ReadResponse in net/textprotoGO-2025-4155 Excessive resource consumption when printing error string for host certificate validation in crypto/x509GO-2025-4175 Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509GO-2026-4337 Unexpected session resumption in crypto/tlsGO-2026-4340 Handshake messages may be processed at the incorrect encryption level in crypto/tlsGO-2026-4341 Memory exhaustion in query parameter parsing in net/urlGO-2026-4342 Excessive CPU consumption when building archive index in archive/zipGO-2026-4403 Improper access to parent directory of root in osCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.