Go Security Review

Runs in the main conversation. The orchestrator builds a Go inventory, selects review clusters, delegates or sequentially executes their worker protocols, validates artifacts, then runs dedup and FP/severity judges.

When to Use

• Auditing Go HTTP, gRPC, GraphQL, or RPC services
• Reviewing backend APIs, daemons, gateways, proxies, or agents with network exposure
• Investigating authorization, SSRF, SQL, template, filesystem, concurrency, or cgo risk
• Reviewing Go libraries, frameworks, command-line tools, or packages without a service boundary

When NOT to Use

• Smart contracts or blockchain modules with chain-specific semantics
• Kernel or eBPF code
• General Go style review without a security objective