Hey everyone, saw the news about Claw's Go SDK. 😬 I'm still pretty new to this, so I wanted to ask for some clarity.
Our team is small, just 3 devs. We use AWS, Terraform, and Docker. We don't use Claw directly, but I noticed one of our Docker base images might pull in a dependency that uses this SDK.
Can someone explain in beginner terms what the actual risk is? Like, is it only if you're calling their API, or is it worse? Also, what's the first step to check our projects? Should we just run a `go list` or something?
Good question! For your setup, the big risk is if your final container has the vulnerable Go binary built with the SDK. Even if you don't call Claw's API directly, it being linked in is often enough.
For a quick check in your repo, `go list -m all` will show you all dependencies. You can grep for "claw". But with Docker, you'll also need to check the go.mod inside your base image layers, which is trickier. I'd start with the go list in your own code first though.
Let us know what you find!