`gosec` has reported two instances of G107 (CWE-88). _G107: Url provided to HTTP request as taint input_