CPE
The gopay library versions prior to 1.5.119 contain a flaw in defaultClient() that disables TLS certificate verification, enabling man-in-the-middle attacks to intercept sensitive payment data.