0.8 The Go labs: security mechanisms you can run
Many chapters here end with "write a small script". Eleven chapters now include that script, as a complete Go program using only the standard library. Each runs on a laptop, with no cloud account, and was run while writing this guide. The outputs shown are real.
mkdir -p ~/seclabs && cd ~/seclabs && go mod init seclabs
mkdir envelope # save the lab as envelope/main.go
go run ./envelope
| Lab | Chapter | What it demonstrates |
|---|---|---|
attackpath |
1 | Attack paths as a graph; greedy chokepoint remediation (3 fixes cut 8 paths) |
envelope |
9 | Envelope encryption, key policy, encryption context as AAD, rotation, crypto-shredding |
spiffe |
23 | SPIFFE IDs in URI SANs, mTLS, authorization by workload identity |
tokens |
24, 39 | Ed25519 JWTs with pinned algorithm and audience; RFC 8693 token exchange |
rebac |
25 | A Zanzibar-style check with an explanation for every ALLOW |
xmlsafe |
32 | What Go's XML parser does with XXE and billion laughs |
race |
35 | A limit-overrun race (20 wins on a card worth 1) and the one-statement fix |
safeupload |
38 | Zip slip stopped by os.Root, content sniffing, size limits |
detect |
51 | Detections as code, with fixtures that gate deployment |
auditlog |
52 | A hash-chained, tamper-evident audit log with an external anchor |
govulncheck |
59 | Reachability: same vulnerable dependency, 1 finding vs 0 |
Labs elsewhere in the series that belong to this guide's topics: SSRF-safe client (HTTPS Ch 22), request smuggling root cause (HTTPS Ch 20), cache leak and poisoning (HTTPS Ch 15), Slowloris and server timeouts (HTTPS Ch 19), rate limiting and idempotency (HTTPS Ch 21), TLS failure diagnosis (TCP/IP Ch 29), firewall policy as tests (TCP/IP Ch 53), a container runtime (Linux Ch 80), and a hardened service image and unit (Linux Ch 82). Larger builds (a WAF, API security, DDoS and bot defences, and an edge security proxy) are in the Go 120-day plan, Weeks 10–17.