Go Secure API Demo

A minimal REST API written in Go to demonstrate secure development practices and static analysis with gosec.

Features

• Single /health endpoint.
• Input validation and explicit content-type handling.
• Configurable port via environment variable.
• Automatic static analysis with GitHub Actions.

Security Learnings

• Avoid hard-coded secrets.
• Validate all inputs and methods.
• Use logging cautiously to prevent data leaks.
• CI integration makes security part of the developer workflow.
• Security scan (gosec) initially flagged missing error handling and server timeouts, which were remediated. Current scan reports zero issues.
• Added Trivy dependency scanning alongside static analysis to simulate supply-chain and SCA checks in CI.

Next Steps

• Add JMT auth example.
• Integrate Vault for secret injection.
• Add Dockerfile and container scan.