binary-contains-insecure-defaultgodebug-settings
The binary contains legacy or insecure DefaultGODEBUG
variable settings.
Modern Go versions allow developers to force legacy (and potentially
insecure) behaviors using //go:debug directives or GODEBUG settings.
While these are sometimes necessary for temporary compatibility, they can introduce security vulnerabilities, disable critical fixes, or compromise build reproducibility.
| Severity: | pedantic |
| Experimental: | false |
See also
- list of all the affected packages
- the source of this tag