hashPassword, _ := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)

    _, err = db.Exec("INSERT INTO users(usrname, password) VALUES(?, ?)", username, password)

I'm not a Go expert. Doesn't this:

1) ignore an error, if any? And then

2) ignore hashPassword and just insert the non-hashed password into the database?

It looks like if someone follows along from home they'll get a syntax error from "usrname" but let's say they fixed that...

The code at the bottom of the article doesn't seem to suffer from the latter issue, but still suffers from the former.