// CORRECT - Works with standalone gosec
// #nosec G304 -- path from internal config, not user input
content, err := os.ReadFile(internalPath)

// INCORRECT - Only works with golangci-lint
content, err := os.ReadFile(internalPath) //nolint:gosec

// CORRECT - Read from environment
apiKey := os.Getenv("ANTHROPIC_API_KEY")
if apiKey == "" {
    return errors.New("ANTHROPIC_API_KEY not set")
}

// INCORRECT - Hardcoded key
apiKey := "sk-ant-api03-..." // NEVER DO THIS

// Path parameters - validate format
var safeAgentTypeRe = regexp.MustCompile(`^[a-z][a-z0-9-]*$`)

func validateAgentType(agentType string) error {
    if !safeAgentTypeRe.MatchString(agentType) {
        return errors.New("invalid agent type")
    }
    return nil
}

// Query parameters - sanitize and bound
func parseLimit(r *http.Request) int {
    limit, err := strconv.Atoi(r.URL.Query().Get("limit"))
    if err != nil || limit < 1 {
        return 10 // default
    }
    if limit > 100 {
        return 100 // maximum
    }
    return limit
}

var safeExtensionRe = regexp.MustCompile(`^\.[a-zA-Z0-9]+$`)

func validateFileExtension(filename string) error {
    ext := filepath.Ext(filename)
    if ext != "" && !safeExtensionRe.MatchString(ext) {
        return errors.New("invalid file extension")
    }
    return nil
}

// CORRECT - Validate path is within expected directory
func safePath(basePath, userInput string) (string, error) {
    // Clean the path
    cleaned := filepath.Clean(userInput)

    // Ensure no directory traversal
    if strings.Contains(cleaned, "..") {
        return "", errors.New("path traversal detected")
    }

    // Build full path
    fullPath := filepath.Join(basePath, cleaned)

    // Verify it's still within base
    if !strings.HasPrefix(fullPath, basePath) {
        return "", errors.New("path escapes base directory")
    }

    return fullPath, nil
}

// CORRECT - Parameterized query
rows, err := db.QueryContext(ctx,
    "SELECT * FROM tickets WHERE id = ? AND status = ?",
    ticketID, status)

// INCORRECT - SQL injection vulnerability
query := fmt.Sprintf("SELECT * FROM tickets WHERE id = '%s'", ticketID)
rows, err := db.Query(query)

// Directory: 0750 (owner: rwx, group: r-x, other: ---)
if err := os.MkdirAll(dir, 0750); err != nil {
    return err
}

// SQLite pragmas for security
db.Exec("PRAGMA journal_mode=WAL")
db.Exec("PRAGMA foreign_keys=ON")

func validateUpload(header *multipart.FileHeader) error {
    // 1. Size limit (10MB)
    if header.Size > 10*1024*1024 {
        return errors.New("file too large")
    }

    // 2. Extension whitelist
    ext := strings.ToLower(filepath.Ext(header.Filename))
    allowed := map[string]bool{
        ".txt": true, ".md": true, ".json": true,
        ".png": true, ".jpg": true, ".pdf": true,
    }
    if !allowed[ext] {
        return errors.New("file type not allowed")
    }

    // 3. Content-Type validation
    contentType := header.Header.Get("Content-Type")
    if !isAllowedContentType(contentType) {
        return errors.New("content type not allowed")
    }

    return nil
}

// Template functions with XSS protection
"markdown": func(s string) template.HTML {
    var buf bytes.Buffer
    if err := goldmark.Convert([]byte(s), &buf); err != nil {
        // ALWAYS escape on error
        return template.HTML(template.HTMLEscapeString(s))
    }
    // goldmark produces safe HTML
    return template.HTML(buf.String())
},

func securityHeaders(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        w.Header().Set("X-Content-Type-Options", "nosniff")
        w.Header().Set("X-Frame-Options", "DENY")
        w.Header().Set("X-XSS-Protection", "1; mode=block")
        w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
        w.Header().Set("Content-Security-Policy",
            "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'")
        next.ServeHTTP(w, r)
    })
}

// Default: No CORS headers (same-origin only)
// If CORS needed, whitelist specific origins

func sanitizeBranchName(branch string) string {
    // Remove common prefixes
    branch = strings.TrimPrefix(branch, "feat/")
    branch = strings.TrimPrefix(branch, "fix/")

    // Replace unsafe characters
    re := regexp.MustCompile(`[^a-zA-Z0-9-_]`)
    return re.ReplaceAllString(branch, "-")
}

// CORRECT - Path validated at construction time
type Spawner struct {
    claudePath string // validated in NewSpawner()
}

func NewSpawner(claudePath string) (*Spawner, error) {
    // Validate the path exists and is executable
    info, err := os.Stat(claudePath)
    if err != nil {
        return nil, fmt.Errorf("claude not found: %w", err)
    }
    if info.Mode()&0111 == 0 {
        return nil, errors.New("claude is not executable")
    }
    return &Spawner{claudePath: claudePath}, nil
}

func (s *Spawner) Run(ctx context.Context, prompt string) error {
    // #nosec G204 -- claudePath is validated at construction time
    cmd := exec.CommandContext(ctx, s.claudePath, "--print")
    // ...
}

s.logger.Info("Agent completed",
    "run_id", runID,
    "ticket_id", ticketID,
    "agent_type", agentType,
    "duration_ms", duration,
    "success", result.Success,
)