Important security fix — replacing AllowedOrigins: ["*"] with explicit origin allowlist and enabling AllowCredentials: true. The old config was dangerous (wildcard + credentials is blocked by browsers, but the intent was wrong).
Good security addition — blocking file:// URLs prevents local file access via git clone. Test coverage is thorough with both valid and invalid cases.
The SCP regex accepts any user (not just git) and any path after :. Consider restricting the user portion or at minimum validating the path doesn't contain path traversal (..). Example concern: admin@localhost:../../etc/shadow.
Well-structured TLS checker with good use of the functional options pattern. Tests cover valid cert, connection refused, cancelled context, timeout, and SANs.
Only DNS SANs are captured (cert.DNSNames). IP SANs (cert.IPAddresses) and URI SANs are ignored. May be worth including depending on monitoring requirements.
Returning an empty CertificateInfo{} when len(state.PeerCertificates) == 0 could mask unexpected situations. Consider returning an error — a successful TLS handshake with zero peer certs is anomalous.
Good implementation. Clean code, solid tests. A couple of observations:
CheckPorts checks ports sequentially — for large port lists this could be slow (5s timeout × N ports worst case). Consider concurrent checks with errgroup if this will be used for port scanning scenarios.
Minor: no validation that port is in valid range (1-65535). net.Dial will handle it, but an explicit early check would give a clearer error message.
