github.com/tsenart/vegeta

Vegeta excels at sustained load generation with minimal resource overhead. The attacker pattern is straightforward - you define targets, configure rate limiting, and consume results through channels. The library handles connection pooling efficiently and maintains consistent request rates even under heavy load. Memory usage stays predictable since results stream through channels rather than accumulating in memory.

The metrics collection is comprehensive, giving you precise latency percentiles, throughput, and success rates. Error handling is transparent - you get detailed error information in results without the library panicking. The ability to export results in multiple formats (JSON, CSV, histograms) makes integration with monitoring systems straightforward.

The biggest pain point is the "+incompatible" versioning - it predates proper Go modules support. Configuration is mostly code-based rather than declarative, which means more boilerplate but also more control. Timeout behavior is configurable but defaults could be more conservative. The library doesn't include built-in retry logic, which is appropriate for load testing but worth noting.

Vegeta is surprisingly straightforward to integrate into Go projects for load testing. The core API revolves around creating an Attacker, defining Targets, and collecting Results - a model that clicks quickly once you see a basic example. The programmatic interface mirrors the CLI tool nicely, making it easy to transition if you've used the command-line version.

Error messages are generally clear when you misconfigure rate limits or target formats, though debugging timing issues requires understanding the internal pacing mechanics. The library handles connection pooling and keep-alives intelligently by default, which saves configuration headaches. Common patterns like custom headers, body payloads, and result aggregation are clean to implement, though you'll likely reference the examples in the GitHub repo frequently since godoc coverage is sparse.

Community support exists but is thin - GitHub issues get responses eventually, and Stack Overflow has basic examples. The learning curve is moderate; you'll spend time understanding Result types and metrics calculation, but the actual attack execution is intuitive. Watch for the `+incompatible` version tag indicating non-standard module versioning.

Vegeta provides a solid API for HTTP load testing with flexible rate control and comprehensive metrics collection. The attacker interface is intuitive, letting you build custom target lists and execute concurrent requests with fine-grained control. The JSON/binary result encoding works well for post-processing attack results.

However, the security posture is concerning. The package is marked as 'incompatible' with proper module versioning, last released in 2018, and pulls in outdated dependencies that may contain known CVEs. TLS configuration requires manual hardening - defaults don't enforce modern cipher suites or minimum TLS versions. The library doesn't validate target URLs rigorously, allowing potential SSRF vectors if you're accepting user input. Error messages can leak internal paths and connection details, requiring careful wrapping in production contexts.

For internal load testing where you control all inputs and targets, it's functional. But the stale dependency tree and lack of secure-by-default configurations make it risky for any security-sensitive context or where untrusted input touches the attack configuration.