Go does not have constant time string comparisons by default. The crypto/subtle package supplies constant time comparisons.