Blog
A user-settable AI base URL decides where your API key gets sent. Validating it to reject userinfo, non-HTTPS schemes and redirects.
Catching secrets by shape rather than by name: patterns for provider key prefixes, URL userinfo and auth headers, plus a fuzzy fallback.
Every finding in a security audit reduced to untrusted input reaching a powerful operation unchecked. One checked chokepoint per boundary fixes it.
Why a write-once boolean still needs a mutex: the Go memory model needs a happens-before edge before another goroutine is guaranteed to see it.
Reassigning a package-level function variable in tests is a latent data race that t.Parallel exposes. The fix is structural, not another lock.
Running OpenSSF Scorecard on a Go project flagged mutable action tags, over-broad workflow token permissions, and a missing maintenance signal.
You cannot test the model, but you can test your code: snapshot the prompt as a golden file and mock the response to cover the ugly cases.
Five AI providers behind one Go interface, including one that shells out to a locally authenticated CLI for networks that allow no API calls.
Persisting an AI conversation in Go: snapshot the messages, prompt and tool metadata, and deliberately never the handlers or the API token.
Generate-and-hope does not work for codegen. Handing the draft to a repair agent with a fixed toolset that has to make build, test and lint pass.
go-tool-base
rust-tool-base
Pioneering
cicd
