Gotestfmt is a standalone Go application with no external dependencies. If you nevertheless find security issues with it please contact security at debugged it.