Securing Go for Production: Best Practices, Supply Chain, Testing
Why Go security matters now, starting from a one-line auth bypass caught by testing. Best practices, fuzzing, govulncheck, and supply chain hygiene, with offline-friendly demos.
I talk about the part of AI nobody demos: security.
Talks and writing on securing AI agents and Go services, built from production work at RedCarbon and from tools I maintain in the open.
4 security talks since 2023 · 5 posts · a 4-part series · maintainer of Argus
Organising an event? Bios, headshot and logos are in the speaker kit.
Start with the argument
What an agent stores that nobody designed, and why fixing it is the framework's job, not yours.
Read the four boundaries
Where the controls go once you accept the prompt will be broken. Four parts, in order.
- 01Crypto-shredding Agent Sessions: Deleting What Your Backups Rememberdue 26 Nov 2026
- 02Assume the Injection Succeeds: Put the Control on the Egressdue 17 Dec 2026
- 03One Agent, One Identity: Least Privilege for AI Agents on GKEdue 14 Jan 2027
- 04The Prompt Is Not a Controldue 28 Jan 2027
Run it on your repo
The same ideas as tools: one reviews a change before it merges, one teaches your agent the checks.
Before the mergeArgus
Open-source AI security review agent written in Go. It runs real scanners (Semgrep, Gitleaks, OSV-Scanner) and reasons about their findings like an analyst would, or serves them over MCP as a toolbox for the AI you already use.
docker run -it -v argus-data:/data -p 8080:8080 ghcr.io/argusappsec/argusIn your agentApplication security skills
The practices of my GoLab talk, packaged so your agent can apply them to your repo: security CI, an audit that reports findings with evidence, and fuzz tests that prove a logic bug before anyone fixes it. Go is the first pack and TypeScript is next; every file a skill writes is tested in CI against a real project first.
npx skills add davideimola/appsec-skillsHear it out loud
The talks this work grew from, with slides and recordings.
Talk · Nov 2026 · GoLab 2026 Talk · Sep 2026 · ComeToCode 2026 Il security engineer che già AI
Security engineering with mainstream AI tools and no enterprise budget: finding and fixing broken access control, auditing dependencies, and growing your own structured security agents.
Talk · Feb 2024 · DevOps Day 2024, DevSecOps Day 2023 Securing Secrets in the GitOps Era
Managing secrets in a GitOps world without committing them in plain text: sealed secrets, secret managers, and CSI drivers compared.
Go further
Everything else I wrote on the topic.
- Apr 2026Stop Prompting. Start Thinking.Not a tutorial. Not a list of prompts. This is the mental model I built working with AI: what works, what I changed my mind about, and why the same method applies whether I'm writing code or writing a blog post.
- Dec 2025AI Will Not Secure Your Codebase. But It Can Reveal Dangerous Git Habits.AI won't secure your codebase, but it can expose the risky Git habits that quietly turn your repository into part of the attack surface.
- Oct 2023Securing Secrets in the Age of GitOpsLearn how to secure secrets in a GitOps workflow using Sealed Secrets, Secrets Managers, and the Secret Store CSI Driver. Managing sensitive data in Kubernetes.
Newsletter
One email a month
A monthly digest of everything I write, build and speak about.