vibecodeagent 0.0.0-stage → 0.1.65

package/dist/resources/skills/builtin/backend-engineering/references/security.md

@@ -0,0 +1,251 @@
+# Security
+
+This file owns the attacks that arrive through your own API: injection, SSRF, CORS, CSRF, rate limiting, and the authorization bug classes that return `200`. It is the canonical source for the SSRF rule set, the CORS allowlist shape, the CSRF decision, and the `429` contract.
+
+Neighbours, so you don't half-solve a problem here: credentials themselves — cookie attributes, session ids, token lifetimes, password hashing, OAuth, RLS, and the IDOR fix — are [auth-and-secrets.md](auth-and-secrets.md), and every value it states is restated here identically or linked, never re-derived. Turning bytes into typed values, rejecting unknown fields, and what a response body may not contain are [validation-and-errors.md](validation-and-errors.md). The status-code table and error envelope are [api-contracts.md](api-contracts.md). Retry/backoff execution against a `429` you received is [concurrency-and-jobs.md](concurrency-and-jobs.md). Alerting on limiter trips is [observability.md](observability.md). Where timeout values come from is [deploy-and-config.md](deploy-and-config.md).
+
+## Operating Posture
+
+Three failure modes, ranked. The first is worse because nothing about it looks wrong:
+
+1. **The hole that answers `200`.** Missing authorization, mass assignment, an IDOR. No exception, no error rate, no alert. Every test passes because every test is written by someone holding a valid session for the row they are asking about. This is OWASP Top 10 A01 and it is number one on frequency, not on drama.
+2. **The hole that hands over the machine.** Injection and SSRF. Rarer, because parameterised queries are the default in every maintained driver — but one of these is a database dump or a set of cloud role credentials, not a leaked row.
+3. **The control that is theatre.** A blocklist, a WAF rule, an escaping helper, a `X-XSS-Protection` header, an unguessable id. These are worse than nothing, because the review that would have found the real bug stops when it sees them.
+
+**Never invent a security control.** Not a "sanitiser", not a regex that strips `../`, not a blocklist of bad words, not a rate limit you picked because it sounded generous. Every number and every rule below is from a published standard, a real default, or this repository's own code, and is checkable. A hand-rolled escaper is the same class of error as a hand-rolled KDF: the app works, the requests succeed, and the property you thought you had was never there.
+
+**Producing nothing is often correct.** If the endpoint accepts no URL, spawns no process, renders no template, and deserialises nothing but JSON, do not add a "security layer" to it — add the authorization predicate and stop. Deleting a bespoke `escapeSql()` in favour of parameters is a better diff than any amount of new code. Adding CSRF tokens to a `Authorization: Bearer` API is cargo cult; say so and don't write it.
+
+## Injection
+
+One rule underneath all seven rows: **user input is never part of the sentence, only ever a value slotted into it by something that knows the grammar.** Escaping is you trying to know the grammar. You don't.
+
+| Class | The vulnerable shape | The fix | The fix that only LOOKS like one |
+| --- | --- | --- | --- |
+| **SQL** | `f"SELECT * FROM users WHERE email = '{email}'"`, or an ORM's `.raw()` / `text()` / `execute()` with an interpolated string | Placeholders (`$1`, `?`, `:name`) — the driver sends the query and the values in separate protocol fields, so no value can ever become syntax | `escapeSql()`, `addslashes`, `mysql_real_escape_string`, `replace("'", "''")`. All fail on a numeric context (`WHERE id = 5 OR 1=1` needs no quote at all) and on multibyte charset tricks. |
+| **Identifier / ORDER BY** | `f"ORDER BY {col} {dir}"` — placeholders cannot bind a table, column, or direction | A literal allowlist map: `{"created": "created_at", "total": "total_cents"}[col]`, defaulting to reject. `dir` is `"ASC"` or `"DESC"`, chosen by an `if` | Quoting the identifier, or a regex like `^[a-zA-Z_]+$` — that is a valid column name from another table, and it is enough to sort-oracle a password hash. |
+| **Command** | `exec(\`git log ${file}\`)` — Node's `exec` runs `/bin/sh -c`, so `;`, `` ` ``, `$( )`, and `&&` are live | `execFile('git', ['log', '--', file])` / `subprocess.run([...], shell=False)` — argv, no shell. `--` ends option parsing, so a file named `--upload-pack=…` stays a filename | Quoting the argument, or `shell: true` "just for the pipe". Also: passing argv but no `--` is still **argument injection** — the string becomes a flag, not a value. |
+| **Path traversal** | `path.join(root, req.params.name)` then `fs.readFile` | `realpath` both sides, then compare with the separator (below). Better: never accept a path — accept an id and look the path up in the database | `replace("../", "")` (defeated by `....//`), decoding once (defeated by `%252e%252e%2f`), and `target.startsWith(root)` — which happily accepts `/srv/uploads-evil`. |
+| **Template (SSTI)** | `render_template_string(f"Hello {name}")`, or any user string compiled as a template | User input is **data passed to** a pre-compiled template, never part of the template source | Escaping the output. SSTI is compile-time; `{{7*7}}` becomes `49` before any output filter runs, and in Jinja/Twig the object graph reaches the interpreter from there. |
+| **Deserialization** | `pickle.loads`, `yaml.load` with `Loader=UnsafeLoader`, Java `ObjectInputStream`, PHP `unserialize`, `node-serialize` on anything from the wire | JSON only, then parse into a typed shape ([validation-and-errors.md](validation-and-errors.md)). `yaml.safe_load` when you must take YAML | A signature or an allowlist of classes bolted onto pickle. The Python docs say it plainly: pickle is not secure — construct the object yourself from parsed fields. |
+| **Log injection** | `logger.info("login failed for " + email)` — a `\n` in `email` forges an entire log line, an ANSI escape rewrites the terminal, and both land in whatever parses your logs | Structured logging: the message is a constant, user values are **fields**. See [observability.md](observability.md) | Stripping `\n`. It misses `\r`, `
`, ANSI CSI, and every ingestion-side format you don't control. |
+| **Header / response splitting** | `res.setHeader('Location', userUrl)`, `Set-Cookie` built from input | Never build a header value from raw input; for `Location`, resolve against an allowlist of paths or hosts | Trusting the runtime. Node *does* throw `ERR_INVALID_CHAR` on CR/LF in a header value — which means CRLF splitting is dead there and **open redirect is not**. `Location: https://evil.com` contains no illegal character and is a complete OAuth code-theft primitive ([auth-and-secrets.md](auth-and-secrets.md)). |
+
+```js
+// Path containment, the only shape that holds. realpath FIRST — otherwise a
+// symlink inside root points anywhere and every string check still passes.
+const root   = await fs.realpath('/srv/uploads');
+const target = await fs.realpath(path.resolve(root, name));   // throws if absent: fine, that's a 404
+if (target !== root && !target.startsWith(root + path.sep)) { // + sep, or "/srv/uploads-evil" passes
+  throw new ForbiddenPath(name);
+}
+```
+
+**Symptom, not rule:** the tell for SQL injection in review is not a missing placeholder — it is a *string* being built anywhere near a query. Grep for template literals and f-strings adjacent to `SELECT|INSERT|UPDATE|DELETE`, and for `.raw(`, `text(`, `execute(` taking a variable. An ORM does not make a codebase safe; it makes the one unsafe call harder to see.
+
+## SSRF
+
+The hub's gate 5 states it: **any URL the user supplies is an SSRF until proven otherwise.** "The user" includes a webhook target, an avatar URL, an RSS feed, an OIDC discovery document, a PDF renderer's `<img src>`, and anything a model chose. Your server is inside the perimeter; the attacker is buying your network position with one string.
+
+The prize is almost never an internal admin page. It is `http://169.254.169.254/latest/meta-data/iam/security-credentials/` — the cloud instance metadata service, one unauthenticated GET, role credentials in the response body. Enable IMDSv2 (`PUT /latest/api/token` with `X-aws-ec2-metadata-token-ttl-seconds`, hop limit 1, which alone kills SSRF-through-a-proxy) — and still implement everything below, because IMDSv2 protects one address and this protects your whole network.
+
+The rule set, all of it, in order:
+
+1. **Allowlist the host when you can.** A webhook to a customer's domain cannot be allowlisted; an OIDC issuer, a payment provider, an internal service can. Exact host set from config, no regex, no suffix matching.
+2. **Resolve, then check every returned address, then connect.** Not the first address — *all* of them. The attacker controls the ordering of their own DNS answers.
+3. **Re-validate on every redirect hop.** This is the one that is always missing. The attacker serves a public, allowlisted page that replies `302 Location: http://127.0.0.1:8080/`, and a client that validated only the initial URL follows it obediently. Disable the HTTP library's own redirect following and drive the chain yourself.
+4. **`https:` only.** No `http:`, no `file:`, no `ftp:`, no `gopher:`, no `data:`. Every "just for local dev" `http:` exception is the exact hole.
+5. **Reject loopback, link-local, private, CGNAT, and every reserved range** — the table below, IPv6 included, including IPv4 wrapped inside IPv6.
+6. **No userinfo in the URL.** `https://api.trusted.example@127.0.0.1/` parses with a host of `127.0.0.1`, and reads to a human as the trusted host. Reject any URL with `username` or `password` set.
+7. **Cap redirects, cap response bytes, set a timeout.** An unbounded body and an infinite stream are denial of service with a `200`.
+
+```
+Blocked v4:  0.0.0.0/8  10/8  127/8  100.64/10 (CGNAT)  169.254/16 (link-local + metadata)
+             172.16/12  192.0.0/24  192.0.2/24  192.168/16  198.18/15  198.51.100/24
+             203.0.113/24  224/4 and above (multicast, reserved, broadcast)
+Blocked v6:  ::  ::1  fc00::/7 (ULA)  fe80::/10 (link-local)  ff00::/8 (multicast)
+             plus ::ffff:a.b.c.d and 64:ff9b::/96 (NAT64) unwrapped and re-checked as v4
+Unparseable addresses are BLOCKED, not allowed. A string your parser gave up on is not proof of safety.
+```
+
+Forms that defeat a naive check for the literal string `127.0.0.1`, every one of them routable: `2130706433` (decimal), `0x7f000001` (hex), `0177.0.0.1` (octal), `127.1` (`inet_aton` fills the middle), `[::ffff:127.0.0.1]`, `localhost.`, `anything.localhost`, and a DNS name the attacker points at `127.0.0.1` on a five-second TTL.
+
+**This repository already contains the worked implementation: `packages/core/src/tools/web-fetch.ts`.** `validasiTarget()` does scheme, host, literal-IP, and post-DNS address checks, `ipv4Terlarang()` / `ipv6Terlarang()` / `parseIpv4Longgar()` / `expandIpv6()` are the range and parser logic including the octal/hex/short forms and the NAT64 and IPv4-mapped wrappers, and the fetch loop calls `validasiTarget()` again **on every redirect target** with `maxRedirections: 0` on the underlying client so no library can follow a hop behind its back. Its limits are `MAKS_REDIRECT = 5`, `MAKS_BYTE = 5 MiB` (truncate, don't fail), `TIMEOUT_MS = 30_000` covering the whole chain — 30s because that call sits inside an agent turn, not inside an HTTP handler. **Read that file before writing SSRF defence; re-deriving these rules from memory is how one of them goes missing.** It also documents the residual hole honestly: it validates resolved addresses then connects by hostname, leaving a DNS-rebinding window that closes only by connecting to the pinned IP with an explicit `Host` header — which undici cannot do without breaking SNI. Copy the honesty too: name the gap you accepted.
+
+Inside a request handler the timeouts are not 30s. **Your outbound timeout must be strictly less than your own handler's, which must be less than your caller's** — the hub forbids "a timeout longer than its caller's". Derive them, don't pick them: a 10s inbound budget with two sequential upstream calls means 4s each, connect timeout 2s, and the arithmetic goes in the config file next to the values ([deploy-and-config.md](deploy-and-config.md)).
+
+## CORS
+
+**CORS is not authorization.** It is a browser-enforced relaxation of the same-origin policy that decides whether *JavaScript on another origin may read your response*. It does not stop the request from being sent, it does not stop it from taking effect, and it means nothing at all to `curl`, a script, or a mobile app. Deleting a CORS header does not fix a vulnerability; it hides it from one class of client.
+
+The account takeover, concretely: you reflect the incoming `Origin` and set `Access-Control-Allow-Credentials: true`. The victim visits `evil.example`, whose page runs `fetch('https://api.example.com/me', {credentials: 'include'})`. The browser attaches the session cookie, your server echoes `Access-Control-Allow-Origin: https://evil.example`, and the attacker's script reads the authenticated response — profile, email, and the CSRF token it needs to then perform writes. **Reflection is a wildcard with extra steps.** People arrive at it because browsers reject a literal `*` when credentials are true; the correct response to that rejection is an allowlist, not a mirror.
+
+```
+Origin: https://app.example.com
+  → look up in an exact string Set from config. Not a regex, not endsWith.
+    "endsWith('example.com')" matches https://evilexample.com.
+    /app\.example\.com/ unanchored matches https://app.example.com.evil.io.
+Access-Control-Allow-Origin: https://app.example.com   # echo the MATCHED entry, never the header
+Access-Control-Allow-Credentials: true                 # only if the API uses cookies at all
+Vary: Origin                                           # or a shared cache serves tenant A's ACAO to tenant B
+Access-Control-Allow-Methods: GET, POST, PATCH, DELETE
+Access-Control-Allow-Headers: content-type, authorization
+Access-Control-Max-Age: 600                            # Chromium caps preflight cache at 7200s, Firefox 86400;
+                                                       # 600 keeps a policy change one redeploy away
+```
+
+Never allowlist the literal origin `null` — sandboxed iframes, `data:` URLs, and local files all send it, so it is an origin any attacker can obtain. `Access-Control-Allow-Origin: *` is correct and safe for a genuinely public, read-only, credential-free API, and nowhere else.
+
+## CSRF
+
+The question is one line: **does the browser attach the credential by itself?**
+
+| Auth mechanism | CSRF applies | Because |
+| --- | --- | --- |
+| Session cookie | **Yes** | The browser sends it on a cross-site form POST without the attacker ever reading it |
+| HTTP Basic, TLS client cert, Windows/NTLM auth | **Yes** | Same — ambient, automatic |
+| `Authorization: Bearer …` from JS memory | **No** | A cross-site page cannot set that header on your origin; a preflight would fail. Adding CSRF tokens here is noise |
+| A cookie holding a JWT | **Yes** | The storage decides, not the token format |
+
+Primary defence, and the cookie line is [auth-and-secrets.md](auth-and-secrets.md)'s, restated unchanged:
+
+```
+Set-Cookie: __Host-sid=<256 bits of CSPRNG, base64url>; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1209600
+```
+
+Set `SameSite` explicitly — Chrome defaults an unset cookie to Lax, other browsers do not, and "the default protects us" is a claim about a browser matrix you have not tested. Two gaps `Lax` does not close: it still rides along on **top-level GET navigation**, so a state-changing GET is CSRF-able no matter what (the hub's doctrine 1 already forbids that GET); and *site* means eTLD+1, so a compromised or attacker-registered subdomain is same-site and unaffected.
+
+Backstop, when the surface is worth it (payments, admin, account changes):
+
+- **Synchroniser token** — random per session, stored server-side, sent in a form field or a custom header, compared with `timingSafeEqual`. The default; it has no subdomain caveat.
+- **Double-submit** — cookie plus matching header. Only in its **signed** form: bind the token to the session with an HMAC, because a subdomain can write a cookie onto your apex and naive double-submit then validates the attacker's own value against itself.
+- **`Origin` check** — reject any state-changing request whose `Origin` is present and not in the CORS allowlist. Cheap, and it costs one `if`.
+- **`Sec-Fetch-Site: cross-site` → reject** on state-changing endpoints. Sent by Chrome, Edge, Firefox, and Safari 16.4+; a browser that omits it falls through to the token.
+
+## Rate Limiting
+
+| Algorithm | Shape | Trade-off |
+| --- | --- | --- |
+| **Fixed window** | `INCR key:{id}:{minute}` + `EXPIRE`. One round trip | Cheapest, and wrong at the seam: 100/min allows 200 in the two seconds spanning a boundary |
+| **Sliding window log** | Sorted set of request timestamps, trim then count | Exact, and memory grows with traffic per key — an attacker chooses your memory bill |
+| **Sliding window counter** | Weighted blend of previous and current window counters | Two counters, error under a few percent, no boundary burst. The pragmatic default for per-IP limits |
+| **Token bucket / GCRA** | Rate plus burst; one level and one timestamp per key | Allows a *deliberate* burst then smooths — matches how real clients behave (page load fires eight calls). The default for per-key API quotas |
+| **Leaky bucket (queue)** | Fixed drain rate, requests queue | Shapes rather than rejects; use for outbound calls to a rate-limited third party, never for inbound — a queue under attack is just a slower outage |
+
+**Limit on several keys at once; one dimension is never enough.**
+
+- **Per API key / user** — the quota, the fairness mechanism, the thing you sell.
+- **Per IP** — the only handle on unauthenticated traffic. For IPv6 bucket by **/64, not /128**: a single host is routinely handed a /64 or larger, so per-address limiting counts an attacker with 18 quintillion free identities.
+- **Per expensive endpoint** — search, export, report generation, anything that fans out or renders. A global 1000/min is meaningless when one of those requests costs 4 CPU-seconds; give the expensive route its own much smaller bucket.
+- **Global concurrency** — a request-rate limiter still permits unbounded *concurrent* slow queries. Cap in-flight work as well ([concurrency-and-jobs.md](concurrency-and-jobs.md)).
+
+The response contract, per the hub's status table:
+
+```
+HTTP/1.1 429 Too Many Requests
+Retry-After: 30                  # RFC 9110 §10.2.3 — delta-seconds or an HTTP-date. The ONLY standard field here.
+Content-Type: application/problem+json
+```
+
+`X-RateLimit-*` is convention, and the IETF `RateLimit` header draft has changed shape between revisions — so pick one form, document it in the API reference, and never let a client infer it. Do not answer `403`, and never `200` with an error body. Your own clients must honour `Retry-After` and add jitter ([concurrency-and-jobs.md](concurrency-and-jobs.md)); trips get a metric, not a log line per request ([observability.md](observability.md)).
+
+**Authentication endpoints get their own, much tighter limits, keyed on the account.** A distributed credential-stuffing run rotates IPs by design, so an IP-only limiter sees a hundred well-behaved clients. NIST SP 800-63B §5.2.2 sets the outer bound you may not exceed: **no more than 100 consecutive failed attempts per account.** Be far stricter, and count *failures*, resetting on success:
+
+```
+POST /login            5 failed attempts / 15 min per account  +  20 / 15 min per IP  +  exponential backoff after
+POST /password/reset   3 / hour per account  +  10 / hour per IP     # every one sends an email you pay for
+POST /token (refresh)  keyed per token family, not per IP            # a spike here is theft — see auth-and-secrets.md
+```
+
+Why 5: someone who forgot their password needs two or three tries and is never inconvenienced; a stuffing bot needs thousands and is stopped at the door. And the lockout response must be **identical** to a normal failed login — a distinct "account locked" message is the user-enumeration oracle [auth-and-secrets.md](auth-and-secrets.md) spends a section closing.
+
+## Authorization Bug Classes
+
+The fix for all four is the same one sentence — **the actor is an argument to the query, and it comes from the session** ([auth-and-secrets.md](auth-and-secrets.md), which owns it). What differs is how each one hides.
+
+**IDOR** — the id in the URL is the only thing selecting the row. Owned in full by [auth-and-secrets.md](auth-and-secrets.md); the detection angle here: it is invisible in tests seeded with one tenant, so the regression test is *tenant B asks for tenant A's id and gets a `404`*.
+
+**Mass assignment** — the request body is handed to the model:
+
+```py
+# The bug. Nothing here mentions is_admin; that is the point.
+user.update(**request.json)        # {"name": "x", "is_admin": true} → is_admin = true
+
+# The fix: an allowlist, and it lives in the parse step, not the update step.
+data = UserPatch(**request.json)   # unknown fields REJECTED — validation-and-errors.md
+user.update(name=data.name)
+```
+The fake fix is a denylist — `{k: v for k, v in body.items() if k != "is_admin"}` — which is correct until someone adds `role_id`, `tenant_id`, `credit_balance_cents`, or `email_verified` next quarter and nobody edits the filter. **Symptom:** the request schema and the database model are the same class.
+
+**Missing function-level authorization** — the endpoint nothing links to. `DELETE /admin/users/:id` guarded by the button not being rendered; the v2 route added beside a v1 route that had the decorator; the GraphQL resolver; the CSV export; the cron-triggered internal handler. Make the router default-deny and **enumerate it in a test**: walk every registered route, assert each declares a policy, and fail CI on the first one that doesn't. A new endpoint should be unreachable until someone names its rule — a checklist item is a rule that gets forgotten, a failing test is one that can't be.
+
+**Confused deputy** — something with more authority than the caller acts on the caller's behalf. The three real shapes: a service that trusts `X-User-Id` from the gateway while its pod is directly reachable on the cluster network; a background job that runs as a superuser and takes `user_id` from a queue message it never authorises; a webhook whose signature you verify but whose *payload target* you don't, so a valid signature moves someone else's money. The deputy must carry the **caller's** authority — a scoped token verified at the destination — and the edge must strip every internal header unconditionally on the way in, whether or not it looks set. **Symptom:** the phrase "it's only reachable from inside the network" appearing in a code comment.
+
+## Comparing Secrets
+
+`==` on bytes returns at the first differing byte. Across a network that difference is nanoseconds buried in noise, and it is still an oracle: average enough samples and the attacker recovers a token one byte at a time in roughly `256 × length` batches of requests. Rate limiting does not fix it, because the signal survives averaging — it only makes the attack take longer. Use `crypto.timingSafeEqual` / `hmac.compare_digest` / `subtle.ConstantTimeCompare`; the exact per-language calls and the full list of what counts as a secret are in [auth-and-secrets.md](auth-and-secrets.md).
+
+Two things that survive the switch and still leak: **length**, since `timingSafeEqual` throws on a mismatch — so compare fixed-length SHA-256 digests of both sides, not the raw strings; and **the lookup**, since fetching every API key and comparing in a loop makes the loop's trip count proportional to how early you matched. Look the key up by an indexed hash, then constant-time compare the one row you got.
+
+## Security Headers on a JSON API
+
+| Header | Verdict on a JSON API |
+| --- | --- |
+| `X-Content-Type-Options: nosniff` | **Matters.** Stops a browser sniffing your JSON as HTML and executing it — the classic path from a reflected value to XSS on your API origin |
+| `Strict-Transport-Security: max-age=31536000; includeSubDomains` | **Matters** (RFC 6797). Add `preload` only if you accept that every current and future subdomain is HTTPS-only, permanently |
+| `Cache-Control: no-store` on authenticated responses | **Matters.** Otherwise a shared proxy or the browser disk cache keeps another user's data |
+| `Content-Disposition: attachment` on user-uploaded downloads | **Matters.** With `nosniff`, it is what stops an uploaded `.html` from executing on your origin |
+| `Content-Security-Policy: default-src 'none'; frame-ancestors 'none'` | **Cheap belt.** Pure JSON executes nothing, but your framework's error page and any docs route do render HTML. Real CSP work belongs on the HTML surface |
+| `X-Frame-Options` / `frame-ancestors` | **Theatre on JSON** — framing a JSON response reveals nothing. Mandatory on any HTML you serve |
+| `X-XSS-Protection: 1; mode=block` | **Theatre, and historically a vulnerability of its own.** Chrome removed the XSS Auditor in version 78. Omit it, or send `0` |
+| `Referrer-Policy`, `Permissions-Policy` | **Theatre on JSON**, correct on HTML pages |
+| `Server`, `X-Powered-By` | Not a control — remove them anyway; version disclosure is free reconnaissance |
+
+## Triage
+
+| Suspicion | The first thing to check |
+| --- | --- |
+| A user saw another tenant's data | The repository/query layer, for a call without the actor argument. The route guard is irrelevant — read the `WHERE` |
+| A field changed that no form exposes | Mass assignment: find the update path, look for a whole-body spread or `**request.json` |
+| Outbound traffic to `169.254.169.254` or a private range | Every handler that accepts a URL, then the redirect follower: is validation re-run per hop, and are redirects disabled in the HTTP client? |
+| Rows from a table the endpoint never queries | String-built SQL. Grep f-strings and template literals near `SELECT\|INSERT\|UPDATE\|DELETE`, and `.raw(` / `text(` / `execute(` with a variable |
+| A file read outside the upload directory | Traversal: is there a `realpath` on **both** sides, and is the prefix check `root + sep`? |
+| A shell command with a user-supplied filename | `shell: true`, and a missing `--` before the operands |
+| Actions users deny performing, cookie session | CSRF: `SameSite` on the session cookie, and whether the endpoint is a state-changing GET |
+| Another site is reading authenticated responses | CORS: does `Access-Control-Allow-Origin` echo the request's `Origin`, and is `Allow-Credentials` true? |
+| Login endpoint under sustained load | Does the limiter key on the **account** as well as the IP, and does it count failures rather than requests? |
+| An internal-only endpoint hit from outside | Does the edge strip `X-User-Id`-style headers unconditionally, or only when it doesn't set them? |
+| Stack traces, SQL, or internal ids in a response | Not this file — [validation-and-errors.md](validation-and-errors.md) |
+| A credential appeared in a repo or a log | Not this file — [auth-and-secrets.md](auth-and-secrets.md), rotate first |
+
+## Never Ship
+
+| Never | Instead |
+| --- | --- |
+| A query built by string concatenation or interpolation | Placeholders; an allowlist map for identifiers and sort direction |
+| An escaping helper standing in for parameterisation | Delete it; the driver already knows the grammar |
+| `exec` with an interpolated command, or `shell: true` | `execFile` / argv, with `--` before user operands |
+| `startsWith(root)`, or stripping `../` | `realpath` both sides, compare against `root + sep` |
+| `pickle.loads`, `yaml.load(…, UnsafeLoader)`, `unserialize` on wire data | JSON, parsed into a typed shape |
+| User input concatenated into a log message | Structured fields, constant message |
+| A user-supplied URL fetched without validation | Allowlist, resolve-then-check-all-addresses, https only, no userinfo, revalidate every hop, cap redirects/bytes/time |
+| Redirect following left to the HTTP library | Disable it; drive the chain and re-validate each target |
+| A blocklist of `127.0.0.1` / `localhost` strings | Range checks over parsed addresses, with unparseable treated as blocked |
+| `Access-Control-Allow-Origin` echoing the `Origin` header | Exact-match Set, echo the matched entry, `Vary: Origin` |
+| An origin allowlist by regex, `endsWith`, or `null` | Exact string membership |
+| A cookie-session endpoint with no CSRF defence | `SameSite=Lax` plus a synchroniser token on the sensitive routes |
+| CSRF tokens on a `Bearer`-authenticated API | Nothing; the browser cannot forge that header |
+| A state-changing `GET` | `POST` / `PATCH` / `DELETE` — `SameSite=Lax` cannot protect a GET |
+| Rate limiting on IP alone, or per-IPv6-/128 | Per key **and** per /64 **and** per expensive endpoint |
+| Login limited at the same rate as everything else | 5 failures / 15 min per account, well under NIST's 100-consecutive ceiling |
+| A distinct "account locked" response | One identical failure response |
+| `429` without `Retry-After`, or `403` for a rate limit | `429` + `Retry-After` (RFC 9110 §10.2.3) |
+| A request body spread into a model | A parsed DTO with an explicit field allowlist |
+| A route whose authorization is "no UI links to it" | Default-deny router plus a test that enumerates every route |
+| An internal header trusted because the network is private | Strip at the edge; the deputy carries the caller's token |
+| `==` on a token, signature, or reset code | Constant-time compare of equal-length digests |
+| `X-XSS-Protection: 1; mode=block` as a control | `nosniff`, HSTS, `no-store` — and CSP where HTML is served |
+
+## Output
+
+Write the code. Then, in a few lines: **what the untrusted input was and where it stopped being untrusted** (the parameterised call, the allowlist, the validated URL); **which of the boundary gates this touched** and whether any is still open; and, for anything network-facing, **the exact limits you set** — timeout, redirect cap, byte cap, rate limit — with the sentence that justifies each. If you refused part of the request — a blocklist someone asked for, an `Origin` reflection, an `http:` exception for local development — say which and why in one line. If the honest answer is that this endpoint needs no new security code, only an authorization predicate, give that answer and stop.

package/dist/resources/skills/builtin/backend-engineering/references/stack-go.md

@@ -0,0 +1,238 @@
+# Go
+
+This file owns what is true about Go and false elsewhere: `context.Context` propagation, `net/http` server and client configuration, `database/sql` pool knobs, error wrapping, goroutine lifetimes, `log/slog`, struct tags, and routing. Every *value* it names is restated from a sibling, never re-derived — timeout budgets and the shutdown order are [deploy-and-config.md](deploy-and-config.md), the pool-size formula is [testing-and-perf.md](testing-and-perf.md) §8, the log field set is [observability.md](observability.md), the error taxonomy and retryability rules are [validation-and-errors.md](validation-and-errors.md), and locks, outbox, and job semantics are [concurrency-and-jobs.md](concurrency-and-jobs.md). Status codes and the response envelope stay in [api-contracts.md](api-contracts.md).
+
+**This is deliberately the shortest stack file.** Go's culture is stdlib-first: there is no dominant framework whose conventions must be encoded, and inventing one — a house `Repository[T]`, a bespoke middleware chain, "our" error package — would be worse than omitting it. What follows is only the places where the language's *zero values* and the stdlib's *defaults* are wrong for a server.
+
+## Operating Posture
+
+Two failure modes, and the first is worse:
+
+1. **The zero value that compiles.** `http.Server{}` has no timeouts, `http.Client{}` has no timeout, `sql.DB` has no connection cap, `SetConnMaxLifetime` is forever. None of these are errors, none fail a test, and all of them work perfectly on the first day. They surface as a server holding ten thousand half-open sockets, or as `FATAL: sorry, too many clients already` at the first traffic spike.
+2. **The goroutine that outlives its reason to exist.** It does not panic, does not log, and does not appear in any metric you have. Memory climbs across a week and the graph looks like a slow leak in the allocator.
+
+**Never invent a Go number.** Not `SetMaxOpenConns(100)` because it is round, not `ReadTimeout: 30 * time.Second` copied from a blog post that did not say `ReadTimeout` also covers the request body, not `runtime.GOMAXPROCS` tuning without a profile. And never write `context.Background()` inside a handler because a function needed a ctx and the linter stopped complaining — that line severs cancellation for everything below it.
+
+**Permission to add nothing.** If `net/http` + `database/sql` + `log/slog` already do the job, add no framework, no DI container, no ORM, and no logging wrapper. The best Go diff of the week is frequently the one that deletes a hand-rolled router in favour of Go 1.22's `ServeMux`.
+
+## 1. context.Context — First Parameter, Always
+
+The habit that buys the most: `ctx` is the first parameter of every function that does I/O, named `ctx`, and it is **never stored in a struct field** (the `context` package says so explicitly; the one legitimate carrier is `*http.Request`, so read it back with `r.Context()`).
+
+| Call | Correct form | What the non-ctx form actually does |
+| --- | --- | --- |
+| SQL | `QueryContext` / `ExecContext` / `QueryRowContext` | `Query` is literally `QueryContext(context.Background(), …)` — uncancellable |
+| Transaction | `db.BeginTx(ctx, nil)` | `db.Begin()` — a transaction that survives the client hanging up |
+| Outbound HTTP | `http.NewRequestWithContext(ctx, …)` | `http.NewRequest` — no deadline, no cancellation, ever |
+| Per-call budget | `context.WithTimeout(ctx, d)` + `defer cancel()` | A missing `cancel()` leaks the context and its timer until the deadline fires; `go vet`'s `lostcancel` catches it |
+| Fire-and-forget from a handler | `context.WithoutCancel(r.Context())` (Go 1.21+), then a fresh timeout | `go work(r.Context())` is cancelled the instant the handler returns |
+
+```go
+func (s *Service) Charge(ctx context.Context, id string) error {
+    ctx, cancel := context.WithTimeout(ctx, 5*time.Second) // third-party budget, deploy-and-config.md §5
+    defer cancel()                                          // frees the timer immediately on the fast path
+    ...
+}
+```
+
+What cancellation buys, concretely: the client gives up at 30s and retries; without a propagated ctx your handler keeps a pool connection and a Postgres backend busy for the full `statement_timeout` on a request nobody is reading. The symptom is diagnostic — `pg_stat_activity` full of `active` queries whose client sockets are gone, and a pool that empties under retry load rather than under real load.
+
+**`context.Canceled` is not an error you own.** `errors.Is(err, context.Canceled)` means the caller went away: log at `INFO`, do not increment the error metric, do not page. `context.DeadlineExceeded` is yours. Conflating them fills the error dashboard with users who pressed Stop.
+
+`ctx.Value` is for request-scoped values that cross API boundaries — request id, trace id, auth principal — keyed by an **unexported struct type** so no other package can collide or read it. Never for optional arguments.
+
+## 2. net/http Server Timeouts — the Zero Value Has None
+
+This is the most common Go production bug. `http.ListenAndServe(":8080", mux)` constructs a `http.Server` whose `ReadTimeout`, `ReadHeaderTimeout`, `WriteTimeout`, and `IdleTimeout` are all zero, and **zero means no limit**. One client that opens a TCP connection and dribbles one header byte per minute holds a goroutine and a file descriptor indefinitely. That is Slowloris, it needs no volume, and it costs the attacker nothing.
+
+```go
+srv := &http.Server{
+    Addr:              ":8080",
+    Handler:           mux,
+    ReadHeaderTimeout: 5 * time.Second,   // Slowloris cutoff: full header set or the conn dies
+    ReadTimeout:       10 * time.Second,  // headers + BODY; must exceed your largest legitimate upload
+    WriteTimeout:      15 * time.Second,  // > 10s handler budget (deploy-and-config.md §5) + write time
+    IdleTimeout:       120 * time.Second, // keep-alive reuse window; longer than any LB idle timeout
+    MaxHeaderBytes:    1 << 20,           // 1 MiB — same as the default, set explicitly so it is reviewable
+    ErrorLog:          slog.NewLogLogger(handler, slog.LevelWarn), // else server errors go to the std logger
+}
+log.Fatal(srv.ListenAndServe())
+```
+
+Behaviour you must know before changing those numbers:
+
+- **`IdleTimeout` falls back to `ReadTimeout` when zero**, and if both are zero there is no idle timeout at all. Setting only `ReadTimeout` therefore silently sets your keep-alive window to the same value and kills connection reuse.
+- **`ReadTimeout` covers the body**, so a 10s read timeout caps upload duration, not upload size. For one upload route, do not raise the global value — extend that route with `http.NewResponseController(w).SetReadDeadline(...)` (Go 1.20+).
+- **`WriteTimeout` starts when the request header is read**, so it bounds the handler's entire execution plus the response write. A `WriteTimeout` shorter than the handler budget truncates the response mid-body, and the client sees a broken connection rather than a status code.
+- **Streaming endpoints (SSE, long polls) need `WriteTimeout` handled per-route** with `SetWriteDeadline`, not a global zero. A global zero to make SSE work reopens Slowloris for every other route.
+
+The client side is the mirror image:
+
+| Default | Reality | Set it to |
+| --- | --- | --- |
+| `http.Client{}.Timeout` | `0` — no limit, no matter what the transport does | A total budget, plus `NewRequestWithContext` |
+| `http.DefaultTransport.MaxIdleConnsPerHost` | `2` (`DefaultMaxIdleConnsPerHost`) | Raise for a hot upstream; at 2 you pay a fresh TCP + TLS handshake per concurrent call and it reads as "the upstream is slow" |
+| `http.DefaultTransport.IdleConnTimeout` | 90s | Fine; keep it under the upstream's idle close |
+| Reusing `http.DefaultClient` for a third party | No timeout, shared transport, shared connection pool | One named `*http.Client` per upstream, constructed once, never per request |
+
+**Never construct a `*http.Client` inside a handler.** Each one gets its own transport and its own connection pool, so nothing is ever reused and the fd count tracks request rate.
+
+## 3. database/sql Pool
+
+`sql.DB` is a pool, not a connection, and `sql.Open` does not connect — it validates the DSN. Verify with `db.PingContext(ctx)` during boot ([deploy-and-config.md](deploy-and-config.md) §3) so a wrong password fails the rollout rather than the first request.
+
+```go
+db.SetMaxOpenConns(9)                   // ceiling from testing-and-perf.md §8 — never a round number
+db.SetMaxIdleConns(9)                   // == MaxOpenConns; the default of 2 churns the other 7
+db.SetConnMaxLifetime(5 * time.Minute)  // under PgBouncer/RDS idle reaping and under DNS-failover TTL
+db.SetConnMaxIdleTime(1 * time.Minute)  // Go 1.15+; returns idle capacity during quiet periods
+```
+
+| Knob | Default | Symptom of leaving it |
+| --- | --- | --- |
+| `SetMaxOpenConns` | `0` = **unlimited** | A burst opens connections until Postgres answers `FATAL: sorry, too many clients already` (SQLSTATE `53300`) — and every other service sharing that database fails at the same moment |
+| `SetMaxIdleConns` | `2` | With `MaxOpen` 9, seven connections are closed and reopened continuously: a latency floor no query tuning removes, and a connection-open rate that tracks traffic |
+| `SetConnMaxLifetime` | `0` = forever | Connections survive a failover; the app keeps talking to a demoted replica, or a proxy silently drops a conn the pool still believes is live (`unexpected EOF` on a random query) |
+
+Two loop rules that produce silent wrong answers rather than errors:
+
+- **`defer rows.Close()` on every `QueryContext`.** A leaked `*sql.Rows` holds its connection until the GC finalizer runs. The symptom is pool exhaustion that a restart fixes and no query is slow.
+- **Check `rows.Err()` after the `for rows.Next()` loop.** A mid-stream network failure ends `Next()` exactly like end-of-results, so an unchecked loop serves a truncated page with `200 OK`.
+
+Pool sizing itself, the `max_connections` ceiling, and the multi-consumer arithmetic are [testing-and-perf.md](testing-and-perf.md) §8 — do not name a Go pool size without it.
+
+## 4. Errors
+
+Wrap with `%w`, once, at each boundary that adds context. `%v` formats the error into a string and **severs the chain**: the caller's `errors.Is(err, sql.ErrNoRows)` returns false, the handler returns `500` for a row that is merely absent, and nothing in the log says why.
+
+| Situation | Form |
+| --- | --- |
+| A condition callers must branch on | Sentinel: `var ErrNotFound = errors.New("not found")`, compared with `errors.Is` |
+| A failure carrying data (field name, retry-after, driver code) | Typed: `type ValidationError struct{…}` with `Error() string`, extracted by `errors.As` |
+| A driver condition (unique violation `23505`, serialization failure `40001`) | `errors.As(err, &pgErr)` then switch on `pgErr.Code` — see [concurrency-and-jobs.md](concurrency-and-jobs.md) |
+| Several independent failures from one operation | `errors.Join` (Go 1.20+) |
+| Adding context on the way up | `fmt.Errorf("charge order %s: %w", id, err)` — no `"failed to"` prefix; six of them stacked is noise |
+
+**Forbidden by name:** `strings.Contains(err.Error(), "duplicate key")`, `err.Error() == "sql: no rows in result set"`, and any retry decision made on a message string. The message is not an API; the driver changes it in a point release and your retry logic quietly becomes a `500` handler. Classification rules live in [validation-and-errors.md](validation-and-errors.md).
+
+`panic` is for programmer error only. Recover in **one** middleware that logs the stack and returns `500` — never per handler, and never to convert an expected failure into control flow. A recovered panic that is not logged is an incident you will never hear about.
+
+## 5. Concurrency
+
+**A goroutine started per request needs a lifetime bound to that request.** `go audit(r.Context())` is a bug in both directions: the request context is cancelled the moment the handler returns, so fire-and-forget work dies instantly; and a goroutine given `context.Background()` outlives the deploy. Use `context.WithoutCancel(r.Context())` (Go 1.21+) to keep the trace id while dropping the cancellation, then attach a fresh deadline. If the work must survive the process, it is not a goroutine — it is a job ([concurrency-and-jobs.md](concurrency-and-jobs.md)).
+
+```go
+ch := make(chan result)          // BUG: unbuffered
+go func() { ch <- work() }()     // blocks forever once the select below takes ctx.Done()
+select {
+case r := <-ch:
+    return r, nil
+case <-ctx.Done():               // handler returns; that goroutine, its stack, and everything
+    return result{}, ctx.Err()   // it references are unreachable and immortal
+}
+```
+
+Fix: `make(chan result, 1)`. The send then completes into the buffer whether or not anyone is left to read it. This exact shape — a timeout on the reader, an unbuffered channel on the writer — is the most common goroutine leak in Go services, and its only symptom is RSS climbing on a graph nobody is watching.
+
+- **Bounded fan-out is `errgroup`**, not a hand-rolled semaphore: `g, ctx := errgroup.WithContext(ctx)` then `g.SetLimit(8)`. The first non-nil error cancels the derived ctx, so the remaining calls stop instead of finishing work nobody will read. An unbounded `for … { go … }` over a user-supplied list is a denial-of-service on your own upstream.
+- **WaitGroup misuse**, ranked: `wg.Add(1)` *inside* the goroutine (`Wait` can return before it runs — the whole point of the counter is lost); a path that returns before `wg.Done()` (deadlock at `Wait`, which reads as a hang, not a panic); and reusing a `WaitGroup` across rounds without letting `Wait` return.
+- **Loop-variable capture** is fixed per-iteration only for modules whose `go.mod` declares `go 1.22` or later. In a module still on `go 1.21`, `for _, u := range users { go send(u) }` sends the last user N times — and the code looks identical either way. Check the `go` directive before believing it is safe.
+- `go test -race` reports only races it actually observes at runtime; a clean run on a single-threaded test proves nothing about a fan-out path. Test methodology is `kerja-agentik`'s.
+
+## 6. Shutdown
+
+Ordering — fail readiness, keep serving 5s, then stop accepting, then drain — is [deploy-and-config.md](deploy-and-config.md) §4 and is not repeated here. The Go mechanics:
+
+```go
+ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
+defer stop()
+<-ctx.Done()
+
+shutdownCtx, cancel := context.WithTimeout(context.Background(), 25*time.Second) // drain_deadline, §4
+defer cancel()
+if err := srv.Shutdown(shutdownCtx); err != nil { /* deadline hit: log, then exit non-zero */ }
+```
+
+- **`ListenAndServe` returns `http.ErrServerClosed` on a clean shutdown.** Treating that return as fatal makes every successful deploy exit non-zero and page someone. Compare with `errors.Is(err, http.ErrServerClosed)` and exit 0.
+- **`Shutdown` does not wait for hijacked connections** — WebSockets and anything that took over the conn. Track those with your own `sync.WaitGroup` and close them yourself, or the drain reports success while sockets are still live.
+- **`Shutdown` knows nothing about your background goroutines.** Queue consumers, tickers, and flushers need their own stop signal; `srv.Shutdown` returning is not "the process is idle".
+
+## 7. log/slog
+
+`log/slog` is stdlib since Go 1.21. Use it; do not wrap it in a house logging package. The field names, levels, and redaction rules are [observability.md](observability.md)'s — slog is only the mechanism.
+
+```go
+h := slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelInfo})
+slog.SetDefault(slog.New(h))
+log := slog.Default().With(slog.String("request_id", rid), slog.String("route", pattern))
+log.InfoContext(ctx, "order rejected", slog.String("error_code", "order_currency_mismatch"))
+```
+
+- **Use the `Context` variants** (`InfoContext`, `ErrorContext`) so a handler can pull trace ids out of `ctx` — otherwise the join key has to be threaded by hand, and it will be dropped in the one helper that mattered.
+- **Prefer typed attrs** (`slog.String`, `slog.Int`) over alternating key/value: an odd argument count emits `!BADKEY` **at runtime**, not at compile time, and it survives review because the line looks fine.
+- **`With` once per request**, not per call site. Rebuilding the same attrs on every line is both slower and the reason field names drift.
+
+## 8. Struct Tags and the Zero-Value Ambiguity
+
+**Always write the JSON tag explicitly.** Without one, Go marshals the exact Go field name, so renaming `OrderId` to `OrderID` in a refactor renames the wire field — a breaking API change with no compile error anywhere in the repo or the tests.
+
+The real trap: **a missing field and a false are indistinguishable.** `json.Unmarshal` leaves an absent field at its zero value, so `{"active": false}`, `{}`, and `{"active": null}` all produce `Active == false`. With `omitempty` on the way out, `false`, `0`, and `""` disappear from the response entirely. On a `PATCH` this means "set this to false" and "do not touch this" are the same bytes.
+
+| Need | Answer |
+| --- | --- |
+| Distinguish absent from `false` / `0` / `""` on a PATCH | `*bool` / `*int64` — `nil` is absent, non-nil is an intentional value |
+| Nullable database column | `sql.Null[T]` (Go 1.22+ generic) or `sql.NullString` etc. |
+| A field to be echoed back untouched | `json.RawMessage` |
+| Reject unknown fields | `dec := json.NewDecoder(r.Body); dec.DisallowUnknownFields()` — restated from [validation-and-errors.md](validation-and-errors.md) |
+| Cap the body | `r.Body = http.MaxBytesReader(w, r.Body, 1<<20)` **before** decoding; the hub's Boundary Checklist gate 2 |
+| A large integer id from untyped JSON | Never decode into `any` — JSON numbers become `float64` and ids above 2^53 lose precision silently. Decode into a struct, or use `dec.UseNumber()` |
+
+Never rely on `omitempty` to hide a secret or an internal field. Use `json:"-"` so the field cannot leak when its value happens to be non-zero.
+
+## 9. Routing
+
+**Go 1.22's `ServeMux` is enough for most services.** It matches methods and wildcards natively, and Go 1.23 exposes the matched pattern for the metrics label:
+
+```go
+mux.HandleFunc("GET /orders/{id}", getOrder)   // method-aware; a POST here gets 405, not 404
+id := r.PathValue("id")                        // no regex, no third-party router
+route := r.Pattern                             // Go 1.23+: the label observability.md §metrics requires
+```
+
+Reach for `chi` (stdlib-compatible `http.Handler`, so nothing else changes) when you hit one of these, and name which one in the commit:
+
+| What you need | Stdlib `ServeMux` | Verdict |
+| --- | --- | --- |
+| Per-group middleware (`/admin/*` behind one auth chain) | Manual wrapping at every registration | `chi` — the missed wrapper is an authorization hole |
+| Sub-router mounted under a prefix, with the prefix stripped | Hand-rolled `StripPrefix` per subtree | `chi` |
+| The matched route pattern for metrics on Go < 1.23 | Not exposed | `chi.RouteContext(ctx).RoutePattern()` — see [observability.md](observability.md) |
+| Constrained params (`{id:[0-9]+}`) | Not supported; validate in the handler instead | Usually *not* a reason — validation belongs at the edge anyway |
+| "It's what I know" / raw benchmark numbers | — | Not a reason. Routing is never the bottleneck; the pool is |
+
+`echo` and `gin` bring their own context type, their own binding, and their own error handling, which means every helper you write is coupled to the framework. Take that trade only for something they give you that `chi` does not.
+
+## Never Ship (Go)
+
+| Never | Instead |
+| --- | --- |
+| `http.ListenAndServe(addr, mux)` in production | An `http.Server` with all four timeouts set (§2) |
+| `http.Client{}` or `http.DefaultClient` for a third party | A named client with `Timeout`, plus `NewRequestWithContext` |
+| A `*http.Client` built inside a handler | One per upstream, built at startup |
+| `db.Query` / `db.Exec` / `db.Begin` | The `…Context` variants, with the request's ctx |
+| `context.Background()` below the entry point | Thread `ctx`; `WithoutCancel` when you genuinely need to outlive the request |
+| `context.Context` in a struct field | First parameter, named `ctx` |
+| `context.WithTimeout` without `defer cancel()` | `defer cancel()`; `go vet` fails otherwise |
+| `sql.DB` with default pool settings | §3, with the number sourced from [testing-and-perf.md](testing-and-perf.md) §8 |
+| `for rows.Next()` with no `rows.Err()` or no `defer rows.Close()` | Both, every time |
+| `fmt.Errorf("...: %v", err)` on a path a caller must classify | `%w` |
+| A retry decision from `err.Error()` text | `errors.Is` / `errors.As` on a sentinel, type, or SQLSTATE |
+| `go work(r.Context())` fire-and-forget | `context.WithoutCancel` + a fresh deadline, or a real job |
+| An unbuffered channel written by a goroutine the reader may abandon | Buffer of 1, or `select` on `ctx.Done()` in the sender too |
+| Unbounded `go` in a loop over user input | `errgroup` with `SetLimit` |
+| `wg.Add(1)` inside the goroutine | Before the `go` statement |
+| Treating `http.ErrServerClosed` as a fatal error | `errors.Is` and exit 0 |
+| `panic` for an expected failure, or a `recover` that logs nothing | Typed error; one recovery middleware that logs the stack |
+| An untagged struct serialized to JSON | Explicit `json:"..."` tags; `json:"-"` for internals |
+| `omitempty` on a field where `false` or `0` is meaningful | `*bool` / `*int64` |
+| Decoding a request body with no size cap | `http.MaxBytesReader` before the decoder |
+| A framework added for routing alone | Go 1.22 `ServeMux` |