go-security is a DAG of packages with no cycles, verified with go list -f '{{.ImportPath}} -> {{join .Imports " "}}' ./.... Higher layers depend only on lower ones; nothing in a lower layer imports back up.
  • L0 — no internal deps: core, jwt, crypto/password, observe, ratelimit, web/cors, saml
  • L1: core/eventcore; web/sessionjwt
  • L2: authn, web/csrf, web/rememberme, web/middleware, oidcprovider
  • L3: authz, oauth2, lockout, web/resource
  • L4: web/auth, adminui
  • L5 (facade): securityhttp
Thick arrows (==>) mark the three cross-layer edges worth calling out by name: securityhttpweb/auth, web/authoauth2, and lockoutauthn. The edge set above is a representative subset, not the full ~45 import edges — this graph tracks layers, not every dependency, so it survives package-internal refactors. saml, oidcprovider, adminui, and core/event are real packages with no docs page yet (shown unlinked above); everything else links to its module page. web/internal/secutil and examples/* are omitted — internal-only and leaf consumers, respectively. Two islands: saml and oidcprovider are unreachable from securityhttp/web/auth — nothing in the facade imports them. web/resource and adminui also sit outside the facade’s dependency tree. go-security-sql is a separate Go module (replace => ../ in its go.mod). The dependency direction is strictly one-way: it imports web/session and lockout, never the reverse. See the securityhttp middleware chain for how the L5 facade assembles these packages into one http.Handler.