Pre-allocated slices, bitmask operations, index-based iteration, strings.Builder with Grow, switch-over-map hot paths, defensive cloning, sync. Once caching, WalkDir over Walk, and defined types avoiding string conversion — patterns visible in code review.

Most performance advice starts with run a profiler. That's correct for micro-optimization. But the patterns in this article are visible in code review. You don't need a flamegraph to know that copying a 408-byte struct in a loop 10,000 times is slower than taking a pointer to it.

These are the patterns we applied across a 50,000-line Go security CLI. Each one has a reason that doesn't require benchmarks to justify.

1.…