Go html/template: Why Auto-Escaping Is Your Friend
Go's html/template escapes output automatically — that is the feature, not a limitation. How it stops the XSS you would otherwise write, and where it gets in the way.
security - DevProfit
How I Keep Secrets Out of Git (Environment Files and .gitignore)
The practical rules for keeping API keys and passwords out of version control — environment files, .gitignore, and what to do when one leaks anyway.