rs/cors package used

No wildcard origins

Origins from environment

MaxAge configured

X-Content-Type-Options header

X-Frame-Options header

Referrer-Policy header

X-XSS-Protection disabled

Content-Security-Policy header

HSTS conditional on TLS

Permissions-Policy header

Middleware as dedicated function

x/time/rate package

Per-IP tracking

Port stripped from IP

Visitor cleanup goroutine

Separate auth limiter

Auth rate strictly lower

429 with Retry-After

Sync.Mutex for visitor map

Limiter as middleware

lastSeen tracking

Parameterized queries used

No fmt.Sprintf in SQL

ORDER BY whitelisted

Path param validated

No hardcoded secrets

Secrets via os.Getenv

Fail-fast on missing secrets

.env.example present

Body field validation

Body size limited

Signal handling

srv.Shutdown called

Shutdown timeout context

Server in goroutine

ErrServerClosed handled

ReadTimeout set

WriteTimeout set

IdleTimeout set

Per-request context timeout

Context passed downstream

Port from environment

CSRF middleware present

CSRF skips safe methods

CSRF token comparison

HttpOnly cookie flag

Secure cookie flag

SameSite=Lax cookie

Crypto random session ID

Security headers outermost

CORS wraps rate limiter

Body size limit present

TLS env var check