Go Security

Dependency Management

• Use Go modules for all dependency management
• The go.sum checksum database provides assurance against module mutation
• Pin dependency versions, including transitive modules
• Run govulncheck regularly to scan for known vulnerabilities in dependencies

Input Validation

• Validate all user input using Go native packages (strconv, regexp) or third-party validators like go-playground/validator
• Never trust input from external sources without validation

XSS Prevention

Use html/template (not text/template) for rendering HTML. It applies contextual autoescaping for HTML, CSS, JavaScript, and URL contexts.