cmd/api/src/services/dogtags/dogtags.go (1)

69-79: Surface unsupported flag types.

If someone adds a new entry to ValidFlags with a typo or genuinely new Type, the loop quietly omits that flag and the API response silently regresses. Tighten this by handling the default branch—either return an error (which means widening GetAllFlags/Provider to return (map[FlagKey]interface{}, error)) or at least emit a hard failure so we catch it in tests instead of production.

cmd/api/src/api/v2/dogtags_test.go (2)

47-56: Close the recorder response body in the tests.

httptest.ResponseRecorder.Result() returns a response whose body should be closed; otherwise, we leak the underlying reader if the test grows more complex. Please add a defer resp.Body.Close() immediately after retrieving the result.

Here is a concrete change you can apply:

-	resp := w.Result()
+	resp := w.Result()
+	defer resp.Body.Close()

---

94-97: Wrap the error-path assertion with body cleanup.

Same as the success path, we should close the body returned by w.Result() to avoid leaking the reader even in tests.

Perform the same adjustment here:

-	resp := w.Result()
+	resp := w.Result()
+	defer resp.Body.Close()

cmd/api/src/api/v2/dogtags.go (1)

9-18: Drop the unused response structs.

DogtagsResponse and DogtagEvaluation are exported but unused, which adds noise and invites confusion about the intended payload shape. Please remove them (or wire them in) once the handler actually serializes that structure.

cmd/api/src/services/dogtags/providers/yaml.go (1)

76-86: Handle integer YAML values in GetFloatFlag.

YAML often emits whole numbers as int even when the schema expects a float. Right now such entries fall through to the default, which is surprising. Convert int/int64 to float64 before giving up.

You can extend the switch like this:

-	if value, exists := p.flags[key]; exists {
-		if floatVal, ok := value.(float64); ok {
-			return floatVal
-		}
-	}
+	if value, exists := p.flags[key]; exists {
+		switch v := value.(type) {
+		case float64:
+			return v
+		case int:
+			return float64(v)
+		case int64:
+			return float64(v)
+		}
+	}

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: LawsonWillard
PR: SpecterOps/BloodHound#1700
File: cmd/api/src/api/v2/saved_queries_test.go:3182-3182
Timestamp: 2025-07-22T20:30:34.839Z
Learning: In Go table-driven tests in cmd/api/src/api/v2/saved_queries_test.go, subtest parallelization with t.Parallel() is acceptable when tests are self-contained, each creating their own mock controller (gomock.NewController(t)) and having isolated mock expectations without shared state between subtests.

cmd/api/src/services/dogtags/dogtags.go (5)

26-30: Consider using constants for flag types to prevent typos.

The Type field is a free-form string, which could lead to runtime errors from typos (e.g., "boo1" instead of "bool").

Define type constants:

+// Flag type constants
+const (
+	FlagTypeBool   = "bool"
+	FlagTypeString = "string"
+	FlagTypeInt    = "int"
+	FlagTypeFloat  = "float"
+)
+
 // FlagSpec defines the specification for a dogtag
 type FlagSpec struct {
 	Type        string `json:"type"`
 	Description string `json:"description,omitempty"`
 }

Then update ValidFlags to use these constants:

 var ValidFlags = map[FlagKey]FlagSpec{
-	BypassCypherQueryLimits: {Type: "bool", Description: "Bypass cypher query limits"},
+	BypassCypherQueryLimits: {Type: FlagTypeBool, Description: "Bypass cypher query limits"},
 	// ... etc
 }

---

32-38: LGTM! ValidFlags provides a clear registry of supported flags.

The hardcoded map prevents runtime addition of arbitrary flags, which is good for security and predictability.

Minor observation: The code supports float type flags (line 79-80), but no flags currently use this type. If float flags are not needed, consider removing the float handling code to reduce complexity.

---

49-52: Consider adding typed accessor methods for better type safety.

The GetAllFlags method returns map[FlagKey]interface{}, requiring clients to type-assert values. This is error-prone and loses compile-time type safety.

Consider adding typed accessor methods to the Provider interface:

type Provider interface {
	GetAllFlags(ctx context.Context) map[FlagKey]interface{}
	GetBoolFlag(ctx context.Context, key FlagKey) (bool, error)
	GetIntFlag(ctx context.Context, key FlagKey) (int64, error)
	GetStringFlag(ctx context.Context, key FlagKey) (string, error)
	GetFloatFlag(ctx context.Context, key FlagKey) (float64, error)
}

This would allow clients to retrieve flags with compile-time type safety:

enabled, err := provider.GetBoolFlag(ctx, dogtags.BypassCypherQueryLimits)
if err != nil {
	// handle error
}

---

54-60: Consider error handling in rawProvider interface.

The rawProvider methods return values directly without errors, forcing providers to either:

1. Always return defaults on failure (hiding errors)
2. Panic on critical errors (poor error handling)

This design prevents callers from distinguishing between:

• A flag explicitly set to its default value
• A flag that failed to load (returning the default as a fallback)

Consider returning errors:

 type rawProvider interface {
-	GetBoolFlag(ctx context.Context, key string, defaultValue bool) bool
+	GetBoolFlag(ctx context.Context, key string, defaultValue bool) (bool, error)
-	GetStringFlag(ctx context.Context, key string, defaultValue string) string
+	GetStringFlag(ctx context.Context, key string, defaultValue string) (string, error)
-	GetIntFlag(ctx context.Context, key string, defaultValue int64) int64
+	GetIntFlag(ctx context.Context, key string, defaultValue int64) (int64, error)
-	GetFloatFlag(ctx context.Context, key string, defaultValue float64) float64
+	GetFloatFlag(ctx context.Context, key string, defaultValue float64) (float64, error)
 }

Then update GetAllFlags to handle errors appropriately (log, return default, or propagate).

---

62-65: Document rawProvider thread-safety requirement
YAMLProvider uses an RWMutex and NoOpProvider is stateless, so both are safe for concurrent calls. Add a comment on the rawProvider interface stating that all implementations must support concurrent use.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

cmd/api/src/services/entrypoint.go (1)

101-110: Don’t log full flag payloads; log keys/count only. Also verify service is actually wired into the API.

Sensitive/license data may be exposed in logs. Limit to keys and a count. And ensure dogtagsService is passed into route/resource wiring; it’s currently only used for logging.

Apply this change:

-	// Log loaded flags on startup
-	flags := dogtagsService.GetAllFlags(ctx)
-	slog.InfoContext(ctx, "DogTags loaded", slog.Any("flags", flags))
+	// Log loaded flags on startup (keys and count only to avoid leaking values)
+	flags := dogtagsService.GetAllFlags(ctx)
+	keys := make([]string, 0, len(flags))
+	for k := range flags {
+		keys = append(keys, k)
+	}
+	slog.InfoContext(ctx, "DogTags loaded", slog.Int("count", len(keys)), slog.Any("keys", keys))

cmd/api/src/services/dogtags/providers/yaml.go (1)

76-86: Handle integer-backed values in GetFloatFlag.

YAML numbers may be unmarshaled as int when configured as whole numbers. Return float64 for int/int64 too.

 func (p *YAMLProvider) GetFloatFlag(ctx context.Context, key string, defaultValue float64) float64 {
   p.mu.RLock()
   defer p.mu.RUnlock()

   if value, exists := p.flags[key]; exists {
-    if floatVal, ok := value.(float64); ok {
-      return floatVal
-    }
+    switch v := value.(type) {
+    case float64:
+      return v
+    case int:
+      return float64(v)
+    case int64:
+      return float64(v)
+    }
   }
   return defaultValue
 }

cmd/api/src/services/dogtags/providers/replicated.go (2)

118-128: Handle integer-backed values in GetFloatFlag.

Support int/int64 to avoid defaulting when the YAML value is a whole number.

 func (p *ReplicatedProvider) GetFloatFlag(ctx context.Context, key string, defaultValue float64) float64 {
   p.mu.RLock()
   defer p.mu.RUnlock()

   if value, exists := p.flags[key]; exists {
-    if floatVal, ok := value.(float64); ok {
-      return floatVal
-    }
+    switch v := value.(type) {
+    case float64:
+      return v
+    case int:
+      return float64(v)
+    case int64:
+      return float64(v)
+    }
   }
   return defaultValue
 }

---

248-263: Abstract MD5 hashing and document spec requirement
Per Replicated docs, MD5 is mandated for RSA-PSS signature verification. Extract the hash algorithm into a strategy interface and add a code comment referencing the Replicated spec.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

cmd/api/src/services/dogtags/dogtags.go (2)

35-41: Remove unused ValidateFlag function.

This function is not referenced anywhere in the repository. Since GetAllFlags only iterates over ValidFlags, unknown keys cannot enter the system through that path.

-// ValidateFlag ensures only known flags are used
-func ValidateFlag(key FlagKey) error {
-	if _, exists := ValidFlags[key]; !exists {
-		return fmt.Errorf("unknown dogtag: %s", key)
-	}
-	return nil
-}
-

---

62-80: Add default case and consider semantic defaults.

Two issues flagged in previous reviews:

1. Missing default case: The switch has no default case. If an invalid type is added to ValidFlags, the flag will be silently skipped without warning.

2. Hardcoded defaults: The literal defaults (false, "", 0, 0.0) may not be semantically correct for all flags. For example, ZoneAllocation defaulting to 0 might mean "no zones allowed" rather than an intended default like -1 for "unlimited".

Apply this diff to add a default case:

 func (s *service) GetAllFlags(ctx context.Context) map[FlagKey]interface{} {
 	result := make(map[FlagKey]interface{})
 
 	// Loop through all known flags and get their values from the provider
 	for flagKey, spec := range ValidFlags {
 		switch spec.Type {
 		case "bool":
 			result[flagKey] = s.provider.GetBoolFlag(ctx, string(flagKey), false)
 		case "string":
 			result[flagKey] = s.provider.GetStringFlag(ctx, string(flagKey), "")
 		case "int":
 			result[flagKey] = s.provider.GetIntFlag(ctx, string(flagKey), 0)
 		case "float":
 			result[flagKey] = s.provider.GetFloatFlag(ctx, string(flagKey), 0.0)
+		default:
+			// Log or panic for invalid flag types
+			panic(fmt.Sprintf("unknown flag type %q for flag %q", spec.Type, flagKey))
 		}
 	}
 
 	return result
 }

For semantic defaults, consider extending FlagSpec:

type FlagSpec struct {
	Type         string      `json:"type"`
	Description  string      `json:"description,omitempty"`
	DefaultValue interface{} `json:"-"`
}

cmd/api/src/services/dogtags/providers/yaml.go (1)

88-107: Consider making missing file an error and adding reload capability.

Two design considerations:

1. Missing file handling: Line 92 returns nil (no error) when the file doesn't exist. This might hide misconfiguration in production where the file path is wrong. Consider logging a warning or making it configurable whether a missing file is an error.

2. No reload mechanism: Flags are loaded only once during construction. If the YAML file changes at runtime, there's no way to pick up the new values without restarting. Consider adding a Reload() or Watch() method if runtime flag updates are needed.

Example for reload:

// Reload reloads flags from the file
func (p *YAMLProvider) Reload() error {
	return p.loadFlags()
}

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

cmd/api/src/services/dogtags/providers/yaml.go (1)

18-33: Sanitize and validate the dogtags file path before loading it.

filePath is consumed verbatim, so a malicious or misconfigured build can point the provider at arbitrary files (../../etc/passwd, /var/secrets/...). Please clean and vet the path (disallow traversal & absolute paths, then store the sanitized value) before calling loadFlags.

@@
-import (
-	"context"
-	"fmt"
-	"os"
-	"sync"
-
-	"gopkg.in/yaml.v3"
-)
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+
+	"gopkg.in/yaml.v3"
+)
@@
 func NewYAMLProvider(filePath string) (*YAMLProvider, error) {
 	if filePath == "" {
 		filePath = "local-harnesses/dogtags.yaml"
 	}
 
+	cleanPath := filepath.Clean(filePath)
+	for _, part := range strings.Split(cleanPath, string(os.PathSeparator)) {
+		if part == ".." {
+			return nil, fmt.Errorf("invalid dogtags file path %q: path traversal detected", filePath)
+		}
+	}
+	if filepath.IsAbs(cleanPath) {
+		return nil, fmt.Errorf("invalid dogtags file path %q: absolute paths are not permitted", filePath)
+	}
+
 	p := &YAMLProvider{
 		flags:    make(map[string]interface{}),
-		filePath: filePath,
+		filePath: cleanPath,
 	}

cmd/api/src/services/dogtags/dogtags.go (1)

65-76: Defend against unknown flag types and make it obvious when specs drift.

Right now an unexpected spec.Type silently drops the flag. Add a default branch (log/return error) so typos or future schema changes are caught immediately.

@@
 	for flagKey, spec := range ValidFlags {
 		switch spec.Type {
 		case "bool":
 			result[flagKey] = s.provider.GetBoolFlag(ctx, string(flagKey), false)
 		case "string":
 			result[flagKey] = s.provider.GetStringFlag(ctx, string(flagKey), "")
 		case "int":
 			result[flagKey] = s.provider.GetIntFlag(ctx, string(flagKey), 0)
 		case "float":
 			result[flagKey] = s.provider.GetFloatFlag(ctx, string(flagKey), 0.0)
+		default:
+			panic(fmt.Sprintf("dogtag %q has unknown type %q", flagKey, spec.Type))
 		}
 	}

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

cmd/api/src/api/v2/model.go (1)

122-122: LGTM! Consistent dependency injection pattern.

The DogtagsService field addition and constructor changes follow the same pattern as other dependencies in the Resources struct. The initialization is correct and consistent with usage in registration.go.

Since this is a WIP prototype, consider adding nil safety checks in a future iteration if the service is optional, or ensure the caller always provides a valid instance.

Also applies to: 135-135, 150-150

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

packages/go/stbernard/command/audit/audit.go (1)

153-160: ExecutionPlan refactor correctly implemented; consider replacing context.TODO().

The refactor to use ExecutionPlan is correct and follows the pattern shown in other analyzers. However, context.TODO() is intended for temporary use during refactoring when the proper context is unclear.

Consider one of these approaches:

Option 1 (Recommended): Thread a context through the call chain:

-func getTicketAudit(env environment.Environment, cwd, startTimestamp, endTimestamp, baseBranch string) (TicketAudit, error) {
+func getTicketAudit(ctx context.Context, env environment.Environment, cwd, startTimestamp, endTimestamp, baseBranch string) (TicketAudit, error) {

Then update the call site in the Run method and use the passed context:

-	result, err := cmdrunner.Run(context.TODO(), executionPlan)
+	result, err := cmdrunner.Run(ctx, executionPlan)

Option 2: If no cancellation/timeout is needed, use context.Background():

-	result, err := cmdrunner.Run(context.TODO(), executionPlan)
+	result, err := cmdrunner.Run(context.Background(), executionPlan)

packages/javascript/bh-shared-ui/src/components/SimpleEnvironmentSelector/SimpleEnvironmentSelector.tsx (1)

150-169: Consider standardizing prop order for consistency.

The two platform selector buttons have their props in different orders. While this doesn't affect functionality, consistent prop ordering improves readability.

Apply this diff to standardize the prop order on the Azure platform button:

                     <li key='azure-platform' className='border-b border-neutral-light-5 pb-2 mb-2'>
                         <Button
+                            className='flex justify-between items-center gap-2 w-full'
                             onClick={handleAzurePlatformClick}
-                            variant={'text'}
                             disabled={disableAZPlatform}
-                            className='flex justify-between items-center gap-2 w-full'>
+                            variant={'text'}>
                             All Azure Tenants
                             <FontAwesomeIcon icon={faCloud} size='sm' />
                         </Button>
                     </li>

packages/javascript/bh-shared-ui/src/views/PrivilegeZones/DefaultRoot.test.tsx (1)

47-47: Consider using a meaningful defaultPath value in the test.

The test passes an empty string (defaultPath='') to DefaultRoot, which may not exercise realistic behavior. Consider using detailsPath or another valid path constant to better reflect actual usage.

Apply this diff:

+import { detailsPath } from '../../routes';
+
 const assetGroupSpy = vi.spyOn(apiClient, 'getAssetGroupTags');
 
 describe('DefaultRoot', () => {
     it('calls getAssetGroupTags for topTagId', () => {
-        render(<DefaultRoot defaultPath='' />);
+        render(<DefaultRoot defaultPath={detailsPath} />);
         waitFor(() => {
             expect(assetGroupSpy).toHaveBeenCalled();
         });

packages/javascript/bh-shared-ui/src/views/PrivilegeZones/Cypher/Cypher.test.tsx (1)

83-91: Consider clarifying the test description.

The test logic is correct and properly validates that base64 special characters are percent-encoded. However, the test description "properly encodes + sign" might be slightly misleading since the input string 'hello>world' doesn't contain a + sign—rather, the + appears in the base64-encoded output (aGVsbG8+d29ybGQ=).

Consider renaming to something like:

-    it('properly encodes + sign into the "View in Explore" link', () => {
+    it('properly encodes base64 special characters (e.g., +) in the "View in Explore" link', () => {

.github/workflows/reusable.docker-content-trust.yml (1)

103-105: Make soft-fail opt-in and add a timeout

Defaulting to continue-on-error can mask real breakages. Gate it behind an input and add a job timeout.

Apply this diff in the job:

-    # continue-on-error until validate signed image can be fully validated post-merge
-    continue-on-error: true
+    # Soft-fail is configurable to avoid masking issues
+    continue-on-error: ${{ inputs.allow_validate_failure }}
+    timeout-minutes: 10

And add this input under on.workflow_call.inputs:

allow_validate_failure:
  type: boolean
  default: false
  description: Allow the validate-image job to soft-fail

packages/javascript/bh-shared-ui/src/views/PrivilegeZones/Details/EntitySelectorsInformation.tsx (1)

26-36: Import shared ItemSkeleton and itemSkeletons instead of redefining
Remove the local ItemSkeleton and itemSkeletons in EntitySelectorsInformation.tsx, add import { ItemSkeleton, itemSkeletons } from '../utils', and delete any now-unused Skeleton/CSSProperties imports.

cmd/api/src/daemons/ha/ha.go (4)

25-27: Consider accepting a context in HAMutex.TryLock (or guarantee non-blocking).

Without a ctx, real HA backends may block the poller on network I/O. Either add ctx context.Context to TryLock(ctx) or document that it must be fast/non‑blocking.

---

32-37: Avoid context.Background() to preserve trace/cancellation where feasible.

Returning Background drops request/service correlation. If you keep the current interface, consider returning a derived/logging context with identifiers; or accept ctx in TryLock (preferred).

---

29-33: Add compile-time interface conformance for safety.

Ensure dummyHA implements HAMutex.

Apply this diff:

 type dummyHA struct{}
 
+// Ensure dummyHA implements HAMutex
+var _ HAMutex = (*dummyHA)(nil)
+
 func (d *dummyHA) TryLock() (LockResult, error) {

---

20-23: Exported types lack GoDoc.

Add brief comments to satisfy linters/docs.

cmd/api/src/daemons/changelog/flag_internal_test.go (2)

246-252: Replace fixed sleep with Eventually to reduce flakiness.

Apply this diff:

-        // Wait for polling cycle
-        time.Sleep(100 * time.Millisecond)
-
-        // Cache should now be enabled
-        cache := manager.getCache()
-        require.NotNil(t, cache)
-        require.Equal(t, 1000, cache.getCapacity())
+        // Cache should now be enabled
+        require.Eventually(t, func() bool {
+            c := manager.getCache()
+            return c != nil && c.getCapacity() == 1000
+        }, 500*time.Millisecond, 25*time.Millisecond)

---

296-303: Replace fixed sleep with Eventually to reduce flakiness.

Apply this diff:

-        // Wait for polling cycle
-        time.Sleep(100 * time.Millisecond)
-
-        // Cache should be enabled since nil HA mutex defaults to primary
-        cache := manager.getCache()
-        require.NotNil(t, cache)
-        require.Equal(t, 1000, cache.getCapacity())
+        // Cache should be enabled since nil HA mutex defaults to primary
+        require.Eventually(t, func() bool {
+            c := manager.getCache()
+            return c != nil && c.getCapacity() == 1000
+        }, 500*time.Millisecond, 25*time.Millisecond)

cmd/api/src/daemons/changelog/flag.go (1)

41-60: Minor: clarify TryLock semantics in comments.

Consider renaming or documenting isPrimary/TryLock semantics (e.g., lease vs. check) to avoid confusion about missing Unlock/renewal.

packages/go/stbernard/analyzers/golang/golang.go (1)

43-49: LGTM: Plan-based execution and exit handling are correct. Consider passing a real ctx.

Use a propagated context instead of context.TODO() when available to enable cancellation/timeouts.

Also applies to: 51-62, 64-64

packages/go/stbernard/workspace/workspace.go (1)

115-121: LGTM: unified plan-based execution. Consider accepting ctx in API.

Change GenerateSchema to accept ctx and pass it to cmdrunner.Run.

Example:

-func GenerateSchema(cwd string, env environment.Environment) error {
+func GenerateSchema(ctx context.Context, cwd string, env environment.Environment) error {
   ...
-  if _, err := cmdrunner.Run(context.TODO(), executionPlan); err != nil {
+  if _, err := cmdrunner.Run(ctx, executionPlan); err != nil {
     return fmt.Errorf("running schemagen: %w", err)
   }

packages/go/stbernard/workspace/golang/build.go (1)

88-94: Migration to ExecutionPlan is correct; consider proper context propagation.

The refactor correctly constructs an ExecutionPlan with all necessary fields and invokes the new Run API. However, using context.TODO() in concurrent goroutines means build operations cannot be cancelled or timed out.

For production-grade build tooling, consider propagating a proper context through BuildMainPackages and buildModuleMainPackages to enable cancellation of long-running builds.

Example enhancement:

func BuildMainPackages(ctx context.Context, workRoot string, modPath string, env environment.Environment) error {
    // ...
    if err := buildModuleMainPackages(ctx, buildDir, modPath, version, env); err != nil {
        return fmt.Errorf("build main packages: %w", err)
    }
    // ...
}

func buildModuleMainPackages(ctx context.Context, buildDir string, modPath string, version semver.Version, env environment.Environment) error {
    // ...
    go func(p GoPackage) {
        defer wg.Done()
        executionPlan := cmdrunner.ExecutionPlan{
            Command: command,
            Args:    args,
            Path:    p.Dir,
            Env:     env.Slice(),
        }
        if _, err := cmdrunner.Run(ctx, executionPlan); err != nil {
            // ...
        }
        // ...
    }(pkg)
    // ...
}

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: jvacca-specterops
PR: SpecterOps/BloodHound#1823
File: packages/javascript/bh-shared-ui/src/views/Explore/ExploreSearch/CypherSearch.tsx:108-148
Timestamp: 2025-09-08T19:01:53.112Z
Learning: In BloodHound's CypherSearch component (packages/javascript/bh-shared-ui/src/views/Explore/ExploreSearch/CypherSearch.tsx), the sharing state reset for sharedIds and isPublic after the two-step permissions update is handled elsewhere in the codebase, so additional state reset callbacks in the updateQueryPermissions function are not needed.

Learnt from: benwaples
PR: SpecterOps/BloodHound#1829
File: packages/javascript/bh-shared-ui/src/views/ZoneManagement/ZoneAnalysisIcon.tsx:26-26
Timestamp: 2025-08-28T19:26:03.304Z
Learning: In packages/javascript/bh-shared-ui/src/hooks/, useZonePathParams is exported through the useZoneParams barrel (useZoneParams/index.ts exports it via wildcard from useZonePathParams.tsx), and usePrivilegeZoneAnalysis is exported through useConfiguration.ts. Both are available via the main hooks barrel import.

Learnt from: superlinkx
PR: SpecterOps/BloodHound#1509
File: packages/go/stbernard/command/license/internal/cmd.go:49-51
Timestamp: 2025-05-29T18:24:23.227Z
Learning: In the stbernard package, use slog for all logging prints instead of fmt.Printf/fmt.Fprintf to maintain consistency with the codebase's logging standards.

Learnt from: superlinkx
PR: SpecterOps/BloodHound#1606
File: cmd/api/src/analysis/azure/post.go:33-35
Timestamp: 2025-06-25T17:52:33.291Z
Learning: In BloodHound Go code, prefer using explicit slog type functions like slog.Any(), slog.String(), slog.Int(), etc. over simple key-value pairs for structured logging. This provides better type safety and makes key-value pairs more visually distinct. For error types, use slog.Any("key", err) or slog.String("key", err.Error()).