go-security-review

# Go Security Review ## Purpose Identify exploitable security vulnerabilities in Go code. Scope is strictly security: injection, authentication/authorization, cryptography, secrets management, input validation, transport security, and HTTP hardening. This skill does NOT cover: performance, concurrency (race conditions), code quality/style, test quality, error handling patterns, or business logic correctness — those belong to sibling vertical skills. ## When To Use - Code touches SQL queries, command execution, or file path operations - Code handles user input, authentication, authorization, or session management - Code involves HTTP handlers, TLS configuration, or cryptographic operations - Code contains hardcoded string literals that may be secrets - Security-focused PR review requested ## When NOT To Use - Performance optimization → `go-performance-review` - Concurrency/race conditions → `go-concurrency-review` - Error handling correctness → `go-error-review` - Code style/lint → `go-quality-review` - Test quality → `go-test-review` - Business logic correctness → `go-logic-review` ## Mandatory Gates ### 1) Execution Integrity Gate Never claim `gosec` or any security tool ran unless it actually produced output. If not run: state reason + exact command. ### 2) Go Version Gate Read `go.mod` for the `go` directive. Do NOT recommend version-specific features above project version. If inaccessible, record `Go version: unknown`. ### 3) Anti-Example Suppression Gate Before ...