Security defaults that belong in every Go HTTP server from day one — CORS, security headers, rate limiting, SQL injection prevention, input validation, secrets management, graceful shutdown, and request timeouts.
89
83%
Does it follow best practices?
Impact
99%
1.32xAverage score across 5 eval scenarios
Passed
No known issues
An engineering team is preparing a Go microservice for deployment in Kubernetes. Kubernetes sends SIGTERM to pods before terminating them, and currently the service just dies mid-request when this happens, causing errors for users. In addition, the ops team has noticed that slow or malicious clients can hold open connections indefinitely, gradually exhausting the server's connection pool.
The service will run behind a Kubernetes ingress and must handle rolling deployments gracefully. The team also wants context-aware database and downstream HTTP calls so that requests don't run forever if the backend becomes unresponsive.
Create a Go HTTP server in the ./service/ directory. It should expose:
GET /api/ping — responds with {"pong": true}GET /api/slow — simulates a slow operation by sleeping for 2 seconds before responding (used to test timeout behavior)The server must be runnable with go run ./service/ and listen on port 8080 (or the port from an env var).
Write a lifecycle_test.sh script that:
SIGTERM signal to the server processlifecycle_results.txtAlso produce a server_config.md that documents all timeout and shutdown values chosen and why.