Echo 4

Apply the Go 1.27 baseline first. These rules cover Echo 4, the github.com/labstack/echo/v4 line, and were checked against 4.15.4, whose module requires Go 1.25.0 or newer. Use v4 APIs and middleware compatible with this major version.

Routes, authentication, and context lifetime

• Supply authentication middleware when creating e.Group, before registering routes or subgroups; later Group.Use calls do not retrofit middleware onto existing routes. Register each protected handler through the protected group.
• Put path rewrites and slash normalization in e.Pre before routing; use e.Use or route middleware for checks requiring matched c.Path() or parameters. Finish route and Echo configuration before serving requests.
• Register only required HTTP methods instead of broad Any handlers. Treat every middleware Skipper as an explicit security exception; test method variants, encoded paths, trailing slashes, and 404/405 handling through the real middleware chain.
• Keep KeyAuthConfig.KeyLookup on a reviewed header transport and make Validator establish a verified principal. Keep ContinueOnIgnoredError false for protected routes; an error handler that returns nil must not enable anonymous execution.
• Authorize the final object, action, and tenant using the verified principal after binding; KeyAuth and group membership do not provide object authorization. Protect operator endpoints and wrapped http.Handler routes with the same checks.
• Keep pooled echo.Context, its response writer, and ParamValues() slices within the request goroutine and