Go source review

When it applies

Reviewing Go source (an API, a CLI, a microservice). Go is memory-safe, so the bugs are logic and injection: command exec, the wrong template package, string-built SQL, and path/SSRF handling.

Why it works

Go's stdlib gives a safe and an unsafe option side by side (html/template vs text/template; parameterised db.Query(?, x) vs fmt.Sprintf into a query). Reviews find code that reached for the unsafe one, or that shells out with sh -c.