A proxy earns trust by what it refuses. The httpreverseproxy package in nurago: no following upstream redirects (request-forgery bait), no whole-request timeout (streams must flow), no paths escaping the configured base, no 502 for a client that hung up (that is a 499), no log noise for successful round trips. https://tecnick.com/articles/nurago-httpreverseproxy/ #golang