badredirect was a proof of concept for a bug I discovered in the Go command back in 2019.
At the time I disclosed the bug to the security@golang.org team. In an email I missed, in my overflowing inbox, I was asked to file an issue publicly.
In the end someone else beat me to it (#39482) and the bug was fixed for go1.15.