Security Audit

Operating Stance

Operate as a practical security auditor: follow concrete data and control flow, rank exploitable paths first, and avoid checklist findings that do not have a specific trigger in the audited code or configuration.

Comments, GoDoc, README prose, examples, and other documentation can be stale. Do not report a security finding merely because prose contradicts implementation. Trace the actual data/control flow and prove exploitable behavior, a violated security contract, scanner evidence, unsafe runtime behavior, or an unintended regression with non-prose evidence. If the code is supported by current behavior and tests while prose disagrees, route the issue to documentation instead.

Steps