> ## Documentation Index > Fetch the complete documentation index at: https://repost.sh/docs/llms.txt > Use this file to discover all available pages before exploring further. # Go Compatibility and Security > Supported Go runtime, dependency, concurrency, transport, platform, verification, and security boundaries. | Axis | Supported | | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Go** | Go 1.25 is the minimum and certified release line. The modules declare `go 1.25.0`, and release verification uses a current Go 1.25 security patch. Newer lines become supported when they enter the release matrix. | | **Platform** | Trusted server-side Go with TCP and TLS sockets. Browser, WebAssembly, desktop, mobile, and other untrusted clients are unsupported because the SDK carries a publish credential. | | **Concurrency** | Generated clients and the runtime are safe for concurrent sends. Admission, buffered bytes, and connection counts remain bounded. | | **HTTP** | HTTP/2 over TLS with HTTP/1.1 fallback, or forced HTTP/1.1. The same raw transport implementation is used on every supported Go platform. | | **Dependencies** | The published root module uses the standard library plus pinned `golang.org/x/net`. OpenTelemetry dependencies stay in the separate `github.com/repost-sh/repost-go/otel` module. | | **Testing** | `reposttest` is part of the root module and adds no production transport or test-framework dependency. | The SDK does not use cgo. A target must provide the networking, DNS, cryptographic randomness, and root-certificate facilities expected by the Go standard library. ## Security posture * Transport security: TLS certificate and hostname verification are mandatory. The built-in transport supports custom trust roots, TLS 1.2 and 1.3 bounds, TLS 1.2 cipher allowlists, encrypted PKCS #8 client keys, and mutual TLS. Deprecated RFC 1423 encrypted PEM is rejected. * Network policy: Redirects are disabled. Ambient proxy variables are ignored; configure one explicit CONNECT proxy. Plain HTTP is limited to canonical loopback hosts. * Proxy authentication: Credentials are requested only after the configured proxy returns a CONNECT `407`. They are never sent to the publish origin. * Resource limits: Request and response bodies, response headers, decompression, nested values, in-flight operations, aggregate buffered bytes, connection counts, and connection lifetimes are bounded. * Redaction: Errors, diagnostics, observers, telemetry, and scripted request headers exclude credentials and payload values. The SDK does not remove personal data from an event; the payload you pass is intentionally sent to Repost. * Callbacks: Credential, DNS, proxy, and telemetry callbacks are application code. They must respect contexts where supplied, return promptly, and remain safe for concurrent use. * FIPS: Version `0.3.0` is not FIPS-certified. It uses the Go runtime's standard cryptographic and TLS implementations. ## Native verification The native Go suite selects and asserts all 415 required transport scenarios without a shared language validator: 329 runtime and custom-transport cases, 14 concurrency cases, 49 production HTTP cases, and 23 enterprise network cases. Inventory tests require every scenario ID exactly once and reject skips in required runners. The suite also exercises generated-client imports, the public generated method tree, the default HTTP/1.1 and HTTP/2 transports over real local sockets, proxy and TLS paths, cancellation, capacity bounds, deterministic testing helpers, response parsing, observer behavior, and runtime shutdown. Race-enabled tests and leak checks cover the root and OpenTelemetry modules. ## Continue Configure proxy, TLS, mTLS, HTTP/2, DNS, and pooling. Understand bounded retries and ambiguous delivery. Compare the generated clients available from one schema.