domains / families / software-engineering / golang-security

golang-security

separate

Security best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory safety, PII in logs, STRIDE/DREAD threat modeling, plus `gosec` SAST, race detection, and fuzz testing. Apply when writing, reviewing, or auditing Go code for security, or when touching crypto, file or network I/O, secrets, user input, or authentication. Not for non-exploitable defensive bugs such as nil panics or slice aliasing (→ See `samber/cc-skills-golang@golang-safety` skill), dependency vulnerability scanning with govulncheck (→ See `samber/cc-skills-golang@golang-dependency-management` skill), or wiring security scanners into CI pipelines (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).

When to use

• writing Go code for security
• reviewing Go code for security
• auditing Go code for security
• injection prevention
• cryptography
• path traversal
• SSRF
• threat modeling

When not to use

• non-exploitable defensive bugs
• nil panics
• slice aliasing
• dependency vulnerability scanning with govulncheck
• wiring security scanners into CI pipelines

Skill page

Source