Go (Golang) find-the-bug interview questions

Question 1

CountWords splits work across goroutines. Under load the process dies with "fatal error: concurrent map writes". Why?

func CountWords(docs []string) map[string]int {
	counts := make(map[string]int)
	var wg sync.WaitGroup
	for _, doc := range docs {
		wg.Add(1)
		go func(d string) {
			defer wg.Done()
			for _, w := range strings.Fields(d) {
				counts[w]++
			}
		}(doc)
	}
	wg.Wait()
	return counts
}

Accepted Answer

Line 9 (Race condition): Go maps are not safe for concurrent writes. Several goroutines update `counts` at once, which the runtime detects and treats as a fatal error that can't be recovered.

Question 2

Average() is used on the latency dashboard. What happens for a service with no requests yet?

// Average returns the mean latency in milliseconds.
func Average(latencies []int) int {
	sum := 0
	for _, l := range latencies {
		sum += l
	}
	return sum / len(latencies)
}

Accepted Answer

Line 7 (Wrong edge case): With an empty slice, len is 0 and integer division by zero panics at runtime ("integer divide by zero"), crashing the dashboard handler.

Question 3

FetchStatus() is called every few seconds by a health checker. After a day the service runs out of file descriptors. Why?

func FetchStatus(client *http.Client, url string) (int, error) {
	resp, err := client.Get(url)
	if err != nil {
		return 0, err
	}
	return resp.StatusCode, nil
}

Accepted Answer

Line 2 (Resource leak): The response body is never closed. Each call leaves a connection and its file descriptor open, and they can't be returned to the pool, so the process eventually hits its open-file limit.

Question 4

This signs session tokens for the API. What should block this PR?

var jwtSecret = []byte("super-secret-change-me")

func SignToken(userID string) (string, error) {
	claims := jwt.MapClaims{
		"sub": userID,
		"exp": time.Now().Add(24 * time.Hour).Unix(),
	}
	return jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString(jwtSecret)
}

Accepted Answer

Line 1 (Leaked secret): The signing key is in source control. Anyone who can read the repo (or a leaked copy) can mint valid tokens for any user, including admins. Load it from a secret store or environment at startup, and fail if it's missing.

Question 5

validateUpload() should only accept PNG files. What does it actually allow?

var errNotPNG = errors.New("only .png files are allowed")

func validateUpload(filename string) error {
	if !strings.HasSuffix(strings.ToLower(filename), ".png") {
		return nil
	}
	return errNotPNG
}

Accepted Answer

Line 4 (Logic inverted): The condition is inverted: every file that is not a PNG passes validation, and real PNGs are rejected.

Go (Golang) find-the-bug interview questions

Go gotchas interviewers love

5 Go spot-the-bug questions

Counting words in goroutines

Average of an empty slice

Unclosed HTTP response body

Hard-coded JWT signing key

Upload file-type check

Attempts distribution