The Requests package before 2.20.0 for Python sends an HTTP Authorization header
to an http URI upon receiving a same-hostname https-to-http redirect, 
which makes it easier for remote attackers to discover credentials by sniffing the network.

package main

import (
	"fmt"
	"sync"
)

func main() {
	wg := sync.WaitGroup{}
	wg.Add(1)
	for i := 0; i < 3; i++ {
		go func(i int) {
			wg.Wait()
			fmt.Printf("%d done\n", i)
		}(i)
	}
	wg.Done()
	fmt.Println("main done")
}

package main

import (
	"fmt"
	"sync"
)

func main() {
	wg := sync.WaitGroup{}
	wg.Add(1)
	for i := 0; i < 3; i++ {
		go func(i int) {
			wg.Wait()
			fmt.Printf("%d done\n", i)
		}(i)
	}
	wg.Done()
	fmt.Println("main done")
}