A Go bug put the private key inside the certificate, in clear text (CVE-2025-6224).
The culprit: h.Sum(key) doesn't hash key. It appends the hash of nothing to key.
pentesterlab.com/training/on-de…
If you use a whole package for one small helper, consider the updates, maintenance and trust you take on. Removing unused functionality or replacing a tiny helper with simpler, tested code you can maintain may be worthwhile.
Remember: the codebase you're reviewing is alive, and it won't stop changing just because you're taking notes.
When documenting a potential vulnerability, don't record only the filename and line number. Code moves, code changes, files get renamed, and your reference might point