It's a nice list of items, but I don't feel like it's informed from actual penetration tests on Go apps. Bad Content-Type headers and DNS rebinding affect almost every Go web application out there.

Any naked Go server is usually vulnerable to DNS rebinding because it doesn't test the Host header.

Edit: see also: http://0xdabbad00.com/2015/04/12/looking_for_security_troubl...