README badges are vulnerabilities

TL;DR: Badges are not magic. They are just image hotlinks, and therefore you need to be able to trust the third party who serves them. Introduction Badges are those cute little colourful rectangles that you see at the top of many READMEs. They often display things like the current version

Snyk badge can't be loaded · Issue #347 · snyk/cli · GitHub

Intermittent 502 responses from camo.githubusercontent.com · Issue

OpenSSF Best Practices Badge Program

Bug][reStructuredText] Badges displayed on GitHub as block

Public logs and status badges · Codefresh

InsidersByte - README Badges

Sonarqube quality badges on gitlab - Stack Overflow

Badges

Part 2: Top trends from analyzing the security posture of open

Add some cool badges in your GitHub Repo – Efficient User

Doc] The Readme badges Dependency Status and devDependency

jenkins-status-badges-plugin/README.md at master · yannickcr

markdown - Why do GitHub workflow badges not render on Jekyll

readme-badges - npm Package Health Analysis