Skip to content

Conversation

@Sneagan
Copy link
Collaborator

@Sneagan Sneagan commented Jul 18, 2025

Today, Kafka and the API run side-by-side due to deployment inconsistency which will soon be eliminated. Once complete, we can and should run only one or the other.

@Sneagan Sneagan requested a review from clD11 July 18, 2025 03:11
// host:6061/debug/pprof/
go func() {
log.Error().Err(http.ListenAndServe(addr, http.DefaultServeMux))
logger.Error("listenandserve", slog.Any("error", http.ListenAndServe(addr, http.DefaultServeMux)))

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use import "net/http/pprof". See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation.

Source: https://semgrep.dev/r/go.lang.security.audit.net.pprof.pprof-debug-exposure


Cc @thypon @kdenhartog

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

as noted in other reviews, this service is behind the VPN so not a concern

@Sneagan Sneagan marked this pull request as ready for review September 25, 2025 14:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants