Golang security research

The article details a security issue in a Go JWT package where audience verification could be bypassed due to improper handling of a double-quote value; although a fix was published in a preview tag, it was not merged into master so many projects remained vulnerable. Snyk triaged the issue, assigned a CVE, and uses this example to discuss the proliferation of proprietary Golang vulnerabilities, their research and scanning efforts, and the need for improved vulnerability management in the Go ecosystem.