Go rsync avoids 6 CVEs by design, not patches

Michael Stapelberg explains how his minimal, memory-safe Go rsync implementation structurally avoided the six vulnerabilities disclosed in January 2025, including arbitrary code execution and file leak bugs. The post walks through how reduced attack surface and memory safety combine as a defence strategy.