CtrlK
BlogDocsLog inGet started
Tessl Logo

tessl-labs/go-security-basics

Security defaults that belong in every Go HTTP server from day one — CORS, security headers, rate limiting, SQL injection prevention, input validation, secrets management, graceful shutdown, and request timeouts.

89

1.32x
Quality

83%

Does it follow best practices?

Impact

99%

1.32x

Average score across 5 eval scenarios

SecuritybySnyk

Passed

No known issues

Overview
Quality
Evals
Security
Files

graceful-shutdown.jsonverifiers/

{
  "instruction": "Implement graceful shutdown that drains in-flight requests before stopping",
  "relevant_when": "Agent creates or modifies a Go HTTP server, sets up a Go API project, or configures server startup",
  "context": "Every Go HTTP server must handle SIGINT and SIGTERM signals for graceful shutdown. Use signal.Notify to catch signals, then call srv.Shutdown(ctx) with a timeout context to drain in-flight requests. Never use log.Fatal(http.ListenAndServe()) as the only server startup pattern -- it drops all connections on Ctrl+C or container termination.",
  "sources": [
    {
      "type": "file",
      "filename": "skills/go-security-basics/SKILL.md",
      "tile": "tessl-labs/go-security-basics@0.2.0"
    }
  ],
  "checklist": [
    {
      "name": "signal-handling",
      "rule": "Agent uses signal.Notify to listen for SIGINT and SIGTERM signals instead of relying on log.Fatal(http.ListenAndServe())",
      "relevant_when": "Agent creates or modifies a Go HTTP server"
    },
    {
      "name": "graceful-shutdown",
      "rule": "Agent calls srv.Shutdown(ctx) with a timeout context (e.g., 10 seconds) to drain in-flight requests before stopping the server",
      "relevant_when": "Agent creates or modifies a Go HTTP server"
    }
  ]
}

tile.json