# Building safe-by-default tools in our Go web application

DevFeed: [Building safe-by-default tools in our Go web application](<https://devfeed.tech/articles/building-safe-by-default-tools-in-our-go-web-application-11981.md>)

Original publisher: [Read original article](<https://incident.io/blog/safe-by-default>)

Author: Lisa Karlin Curtis

Published: 2021-11-22T00:00:00Z

Content type: article

Language: en

Sources: [The incident.io Blog](<https://devfeed.tech/sources/the-incident-io-blog.md>)

Topics: [web applications](<https://devfeed.tech/topics/web-applications.md>), [Go Language](<https://devfeed.tech/topics/go-language.md>), [API](<https://devfeed.tech/topics/api.md>), [data](<https://devfeed.tech/topics/data.md>), [ci](<https://devfeed.tech/topics/ci.md>), [bug](<https://devfeed.tech/topics/bug.md>), [Code](<https://devfeed.tech/topics/code.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [bug](<https://devfeed.tech/tags/bug.md>), [building](<https://devfeed.tech/tags/building.md>), [ci](<https://devfeed.tech/tags/ci.md>), [code](<https://devfeed.tech/tags/code.md>), [customer](<https://devfeed.tech/tags/customer.md>), [data](<https://devfeed.tech/tags/data.md>), [go](<https://devfeed.tech/tags/go.md>), [incident](<https://devfeed.tech/tags/incident.md>), [incident-channel](<https://devfeed.tech/tags/incident-channel.md>), [incident-management](<https://devfeed.tech/tags/incident-management.md>), [incident-response](<https://devfeed.tech/tags/incident-response.md>), [outage](<https://devfeed.tech/tags/outage.md>), [post-mortem](<https://devfeed.tech/tags/post-mortem.md>), [slack-incident](<https://devfeed.tech/tags/slack-incident.md>), [testing](<https://devfeed.tech/tags/testing.md>), [web](<https://devfeed.tech/tags/web.md>)

## AI overview

The article describes how incident.io protects sensitive customer data in a multi-tenant Go web application. It discusses automated unit and integration testing in CI, the limitations of relying on test coverage alone, and a middleware applied by default to authenticated API endpoints to enforce organization-scoped resource responses.

## Source excerpt

Moving fast and breaking things is all well and good, but keeping our customer data safe isn't something we can compromise on. Find out how we do it!