golang-securitylisted

# Go Security Engineering Protect a defined asset and trust boundary. For review-only requests, report evidence and remediation without changing code. For implementation requests, make the smallest verified change in scope. ## Establish the security context Before judging code, identify: - the asset, attacker capability, entry point, and trust boundary; - authentication and authorization assumptions; - data sensitivity and tenancy boundaries; - network and deployment controls that are actually present; - the concrete source-to-sink path; - existing security policy and accepted risk. Do not report a vulnerability from a suspicious pattern alone. Confirm attacker influence, reachable behavior, missing controls, and realistic impact. Cite the exact code path and state assumptions. Calibrate severity from impact and exploitability rather than a fixed label attached to an API. ## Review high-risk boundaries ### Injection and code execution - Pass SQL values through driver parameters. Map identifiers, clauses, and sort directions from fixed allowlists. - Pass command arguments directly to exec.Command or an equivalent API. Avoid invoking a shell with attacker-influenced text. - Use html/template for untrusted HTML content and preserve contextual escaping. Treat template.HTML and related safe types as reviewed trust-boundary escapes. - Validate structured input before using it to form queries, paths, templates, or interpreter expressions. ### Files, archives, and uploads R