As of Go 1.18, fuzz tests are supported and will be supported by OSS-Fuzz

https://go.dev/doc/security/fuzz/

We should integrate some fuzz testing and integrate that with Google's upstream oss-fuzz platform to enhance the overall security posture of Cobra.