CtrlK
BlogDocsLog inGet started
Tessl Logo

tessl-labs/go-security-basics

Security defaults that belong in every Go HTTP server from day one — CORS, security headers, rate limiting, SQL injection prevention, input validation, secrets management, graceful shutdown, and request timeouts.

89

1.32x
Quality

83%

Does it follow best practices?

Impact

99%

1.32x

Average score across 5 eval scenarios

SecuritybySnyk

Passed

No known issues

Overview
Quality
Evals
Security
Files

task.mdevals/scenario-4/

Reliable Go HTTP Service for a Kubernetes Deployment

Problem Description

An engineering team is preparing a Go microservice for deployment in Kubernetes. Kubernetes sends SIGTERM to pods before terminating them, and currently the service just dies mid-request when this happens, causing errors for users. In addition, the ops team has noticed that slow or malicious clients can hold open connections indefinitely, gradually exhausting the server's connection pool.

The service will run behind a Kubernetes ingress and must handle rolling deployments gracefully. The team also wants context-aware database and downstream HTTP calls so that requests don't run forever if the backend becomes unresponsive.

Output Specification

Create a Go HTTP server in the ./service/ directory. It should expose:

  • GET /api/ping — responds with {"pong": true}
  • GET /api/slow — simulates a slow operation by sleeping for 2 seconds before responding (used to test timeout behavior)

The server must be runnable with go run ./service/ and listen on port 8080 (or the port from an env var).

Write a lifecycle_test.sh script that:

  1. Starts the server in the background
  2. Sends a SIGTERM signal to the server process
  3. Verifies the server exits cleanly (exit code 0) and writes "graceful" or "stopped" to a results file lifecycle_results.txt

Also produce a server_config.md that documents all timeout and shutdown values chosen and why.

evals

tile.json