Google Gen AI SDK for Go 1

Apply the Go 1.27 baseline first. These rules cover google.golang.org/genai 1.x, researched against v1.76.0. The module's Go 1.24 minimum is a build requirement, not a security-support promise. Check the selected backend, API version, and model before using a feature.

Client identity and outbound requests

• Set ClientConfig.Backend explicitly and construct Project, Location, APIKey, and Credentials from trusted deployment configuration. Environment selection can change the backend or credential mode; use a dedicated client for each project and tenant trust boundary, with narrowly scoped Vertex IAM permissions.
• Keep long-lived Gemini API keys on the server. Never log ClientConfig or constructor errors: the latter can print the configuration, including secrets. Treat the config and its maps as immutable after NewClient, which retains references to them.
• When supplying ClientConfig.HTTPClient, configure its authentication transport deliberately for Vertex. The custom client path does not automatically wrap your client with default credentials; test the resulting identity and endpoint before deployment.
• Allowlist HTTPS origins and paths for HTTPOptions.BaseURL, per-call overrides, environment-derived base URLs, and process-wide defaults. Reject redirects to unapproved destinations in HTTPClient.CheckRedirect; the SDK sends x-goog-api-key on requests, so a redirect can carry it outside the intended service.
• Keep HTTPOptions.Headers, ExtraBody, and request providers under server control. Per-call options can replace routing, credentials,