vetkit.go.debug.pprof-exposed
net/http/pprof is blank-imported, which registers the /debug/pprof handlers on http.DefaultServeMux. If that mux is served publicly, anyone can dump goroutines, heap contents and CPU profiles.
Last updated:
Suite: Security
go
net/http/pprof is blank-imported, which registers the /debug/pprof handlers on http.DefaultServeMux. If that mux is served publicly, anyone can dump goroutines, heap contents and CPU profiles.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Drop the import in production builds, or mount the pprof handlers on a separate listener bound to localhost / behind authentication.
References
Source: packages/engine/rules/sast/go.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.