go-defensive

Go Defensive Programming

Hardening Go code is not paranoia — it is the discipline of making your boundaries honest. Copy what crosses them, clean up what you opened, model time and randomness honestly, and never let a panic escape a package.

Core Rules

1. Copy slices and maps at API boundaries. They are reference types — leaking the backing array leaks mutation.
2. defer the cleanup right after the acquire. f, err := os.Open(...); defer f.Close().
3. Verify interface compliance at compile time: var _ I = (*T)(nil).
4. Model time and durations with time.Time and time.Duration, never raw ints.
5. Inject now func() time.Time instead of calling time.Now() directly in production code.
6. Enums start at iota + 1 so the zero value is invalid.
7. crypto/rand for secrets, never math/rand.
8. Panics never cross package boundaries. Convert to errors at the edge.
9. Avoid mutable package-level state. Inject dependencies instead.

Boundary Hardening Checklist

When you touch an exported function or method, walk this list in order:

Copy at API Boundaries

// Receiving: copy a slice we'll retain
func (d *Driver) SetTrips(trips []Trip) {
    d.trips = make([]Trip, len(trips))
    copy(d.trips, trips)
}

// Returning: copy a map so callers can't mutate our state
func (s *Stats) Snapshot() map[string]int {
    out := make(map[string]int, len(s.counters))
    for k, v := range s.counters {
        out[k] = v
    }
    return out
}

Read references/boundary-copying.md when deciding which boundaries actually need copies (and when copying is wasted work).