Golang SecuritySAFE

A collection of Agent Skills Standard and Best Practice for Programming Languages, Frameworks that help our AI Agent follow best practies on frameworks and programming laguages

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: golang-security
description: Secure Go backend services against common vulnerabilities. Use when implementing input validation, crypto, or SQL injection prevention in Go.
metadata:
  triggers:
    files:
    - 'crypto/rand'
    keywords:
    - argon2
    - sanitize
    - jwt
    - bcrypt
    - validation
    - input validation
    - sql injection
---
# Golang Security Standards

## **Priority: P0 (CRITICAL)**

## Implementation Guidelines

### Input Validation

- **Validation**: Use `go-playground/validator` or `google/go-cmp` for struct validation.
- **Sanitization**: Sanitize user input before processing. Use `bluemonday` for HTML sanitization.

### Cryptography

- **Random**: ALWAYS use `crypto/rand`, NEVER `math/rand` for security-sensitive operations (tokens, keys, IVs).
- **Hashing**: Use **Argon2id** for password hashing (`golang.org/x/crypto/argon2`). NOT use bcrypt (weaker) or MD5/SHA1 (insecure). Recommended params: `time=1, memory=64MB, threads=4`.
- **Encryption**: Use `crypto/aes` with GCM mode for authenticated encryption.

### SQL Injection Prevention

- **Parameterized Queries**: ALWAYS use `$1, $2` placeholders with `database/sql` or ORM (GORM, sqlx).
- **No String Concatenation**: Never build queries with `fmt.Sprintf()`.

### Authentication

- **JWT**: Use `golang-jwt/jwt` v5+. Enforce `RS256` (preferred) or `HS256`. **Reject `none` and symmetric algorithms for multi-service auth**. Validate `alg`, `iss`, `aud`, `exp` claims.
- **Sessions**: Use secure, httpOnly cookies with `gorilla/sessions`.

### Secret Management

- **Environment Variables**: Load secrets via `godotenv` or Kubernetes secrets.
- **No Hardcoding**: Never commit API keys, passwords, or tokens to Git.

## Anti-Patterns

- **No `math/rand` for Security**: RNG predictable. Use `crypto/rand`.
- **No `fmt.Sprintf()` for SQL**: Causes SQL injection. Use placeholders.
- **No bcrypt or MD5 for Passwords**: Use `argon2id` exclusively.
- **No Exposed Error Details**: Don't leak stack traces to clients in production.

## References

- [Implementation Examples](references/implementation.md)

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.