a public repository, read by nittim
caddyserver/caddy security audit
What nittim read in this repository, and what it found. Public repository, public reading — sourced from its own code and dependency manifests, nothing else.
Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Go · 78.7k stars · last push November 4, 2026
caddyserver/caddy is a fast and extensible HTTP/1-2-3 web server written in Go that provides automatic HTTPS support across multiple platforms. The repository contains the core server implementation and related components for handling web traffic securely and efficiently.
Nittim scanned 473 files in caddyserver/caddy and found evidence of concern. The scan identified 2 vulnerable runtime dependencies. Two packages require attention: github.com/go-jose/go-jose/v3 with advisory GHSA-mgcc-cww5-fp2q and github.com/go-jose/go-jose/v4 with advisory GHSA-mgcc-cww5-fp2q.
Developers should update the vulnerable packages to patched versions and rescan the repository to confirm the issues are resolved. Running a full audit will provide detailed information about each vulnerability and help prioritize remediation efforts.
Written from nittim's own scan on October 29, 2026; rescanned when the repository changes.
No verdict. The rule-based check reports hard evidence, or reports that it found none. Neither is a judgment on whether this code is safe to ship.
What was read — rule-based scan
Rule-based checks run on nittim's servers — a secret scanner and a dependency check, no model in the path. The code reached those two and stopped there.
Read 484 of 484 eligible files. Commit 4681541. 2026-11-04.
What the scanners found
- Committed secrets on production paths
- 0
- Vulnerable runtime dependencies
- 2
github.com/go-jose/go-jose/v3 (GHSA-mgcc-cww5-fp2q), github.com/go-jose/go-jose/v4 (GHSA-mgcc-cww5-fp2q)
Run it yourself
Scan any public repository in seconds — no sign-in, no card. Audit it to have a model read the code. Loop the report into your assistant to get the fixes applied and re-checked.
Scan your own repoQuestions
- What did nittim read in caddyserver/caddy?
- nittim read 484 of 484 eligible files in caddyserver/caddy. The reading ran on November 4, 2026. It was taken at commit 4681541.
- Did nittim find committed secrets or vulnerable dependencies in caddyserver/caddy?
- The rule-based scan found 0 committed secrets and 2 vulnerable dependencies in caddyserver/caddy. Affected: github.com/go-jose/go-jose/v3 (GHSA-mgcc-cww5-fp2q), github.com/go-jose/go-jose/v4 (GHSA-mgcc-cww5-fp2q).
- Is caddyserver/caddy production ready?
- A free scan is not a verdict. A full audit gives one.
More like this
Add the badge to your README
[](https://nittim.com/library/caddyserver/caddy)