Go Security Audit

Security is not a feature — it's a property. Every line of code either maintains it or degrades it.

1. Input Validation

NEVER trust user input. Validate at the boundary:

// ✅ Good — validate before use
func (h *Handler) handleCreate(w http.ResponseWriter, r *http.Request) {
    // Limit body size
    r.Body = http.MaxBytesReader(w, r.Body, 1<<20) // 1 MB