TL;DR
* Go's built-in profiler, pprof, exposes CPU, heap, goroutine, block, and mutex profiles through net/http/pprof; run it on a dedicated localhost-only port.
* go tool pprof -http=:8080 "http://localhost:6060/debug/pprof/profile?seconds=30" collects a 30-second CPU profile
