mux in a global state about goji HOT 1 CLOSED

Yeah, they'd be able to expose routes to your app. But people would already be able to do this using net/http, which the top-level goji package also goes through.

Many people actually want this behavior explicitly. For instance, it means that the net/http /debug/ endpoints work as expected. It's your responsibility to block these in nginx (or similar) if you don't want to expose them to the world.

It's not "unsafe" in the thread safety sense, in the off chance that's what you mean. I'm pretty sure Goji is entirely thread-safe.

But if you want to completely control your mux and all its routes, I'd definitely instantiate it yourself.

from goji.