| 1 |
Types, structs, interfaces, errors |
Toy-to-real transition; config/storage building blocks |
| 2 |
Control flow, packages, testing, goroutines/channels |
Strong (race detector, benchmarks, worker pools) |
| 3 |
Context, I/O, JSON, regex, time |
Strong (OWASP-aware, PCI/GDPR framing) |
| 4 |
Generics, sync.Pool, pprof, graceful shutdown |
Most senior-feeling early week; metrics self-rolled, not Prometheus |
| 5 |
Raw TCP/UDP, DNS, connection pooling |
Uncommonly deep L4 work |
| 6 |
TLS, PKI, mTLS, HMAC, AES-GCM, ECDSA tokens |
Strongest security content in weeks 1–6 |
| 7 |
L4 load balancer (RR/weighted/least-conn), circuit breaker |
Real, but zero _test.go |
| 8 |
Binary protocols, cert rotation, race audit, load test |
Best debugging-methodology week; docs promise SIGHUP that code never wires |
| 9 |
HTTP/1.1 internals, timeouts, reverse proxy, WebSocket |
Strong; no DB, no gRPC despite covering HTTP/2 |
| 10 |
WAF (OWASP Top 10 detection) |
Best security-engineering week; regex-chain has no perf story |
| 11 |
API auth (API key/HMAC/ECDSA), validation, PII, CORS |
Hand-rolled crypto/JWT with no "use a real library" caveat; no bcrypt |
| 12 |
Integration, slog, SIGHUP reload, first real tests + fuzzing |
Testing/observability finally treated as first-class |
| 13 |
DDoS detection (5 rate-limit algos, SYN/Slowloris, PoW) |
Production-level within its narrow domain |
| 14 |
Bot detection (JA3, ASN classification, PoW) |
Vendor-informed, realistic; JA3 is an acknowledged approximation |
| 15 |
SRE hardening (health checks, FD-inherit restart, chaos middleware) |
Most broadly transferable week of all 17 |
| 16 |
Attack simulation, profiling, coverage, ADRs, fuzzing |
Most senior-engineer-shaped week (ADR discipline, adversarial self-review) |
| 17 |
Capstone assembly (single main.go, build-vs-buy analysis) |
One large integration, not a portfolio |
