diff --git a/internal/services/gateway/action/secret.go b/internal/services/gateway/action/secret.go
index a3b5966..a74e1c0 100644
--- a/internal/services/gateway/action/secret.go
+++ b/internal/services/gateway/action/secret.go
@@ -21,7 +21,6 @@ import (
 	csapi "agola.io/agola/internal/services/configstore/api"
 	"agola.io/agola/internal/services/types"
 	"agola.io/agola/internal/util"
-	"go.uber.org/zap"
 
 	errors "golang.org/x/xerrors"
 )
@@ -66,11 +65,6 @@ type CreateSecretRequest struct {
 	Path             string
 }
 
-type CreateSecretHandler struct {
-	log               *zap.SugaredLogger
-	configstoreClient *csapi.Client
-}
-
 func (h *ActionHandler) CreateSecret(ctx context.Context, req *CreateSecretRequest) (*csapi.Secret, error) {
 	isVariableOwner, err := h.IsVariableOwner(ctx, req.ParentType, req.ParentRef)
 	if err != nil {
diff --git a/internal/services/gateway/api/api.go b/internal/services/gateway/api/api.go
index fed052b..9621fbb 100644
--- a/internal/services/gateway/api/api.go
+++ b/internal/services/gateway/api/api.go
@@ -78,22 +78,22 @@ func httpError(w http.ResponseWriter, err error) bool {
 	switch {
 	case errors.Is(err, &util.ErrBadRequest{}):
 		w.WriteHeader(http.StatusBadRequest)
-		w.Write(resj)
+		_, _ = w.Write(resj)
 	case errors.Is(err, &util.ErrNotFound{}):
 		w.WriteHeader(http.StatusNotFound)
-		w.Write(resj)
+		_, _ = w.Write(resj)
 	case errors.Is(err, &util.ErrForbidden{}):
 		w.WriteHeader(http.StatusForbidden)
-		w.Write(resj)
+		_, _ = w.Write(resj)
 	case errors.Is(err, &util.ErrUnauthorized{}):
 		w.WriteHeader(http.StatusUnauthorized)
-		w.Write(resj)
+		_, _ = w.Write(resj)
 	case errors.Is(err, &util.ErrInternal{}):
 		w.WriteHeader(http.StatusInternalServerError)
-		w.Write(resj)
+		_, _ = w.Write(resj)
 	default:
 		w.WriteHeader(http.StatusInternalServerError)
-		w.Write(resj)
+		_, _ = w.Write(resj)
 	}
 	return true
 }
@@ -133,7 +133,7 @@ func httpErrorFromRemote(w http.ResponseWriter, resp *http.Response, err error)
 		} else {
 			w.WriteHeader(http.StatusInternalServerError)
 		}
-		w.Write(resj)
+		_, _ = w.Write(resj)
 		return true
 	}
 	return false
diff --git a/internal/services/gateway/api/user.go b/internal/services/gateway/api/user.go
index 75c1c58..5ae51f5 100644
--- a/internal/services/gateway/api/user.go
+++ b/internal/services/gateway/api/user.go
@@ -176,7 +176,7 @@ func createUserResponse(u *types.User) *UserResponse {
 	for tokenName := range u.Tokens {
 		user.Tokens = append(user.Tokens, tokenName)
 	}
-	sort.Sort(sort.StringSlice(user.Tokens))
+	sort.Strings(user.Tokens)
 
 	for _, la := range u.LinkedAccounts {
 		user.LinkedAccounts = append(user.LinkedAccounts, &LinkedAccountResponse{
diff --git a/internal/services/gateway/gateway.go b/internal/services/gateway/gateway.go
index 818b947..efbd24c 100644
--- a/internal/services/gateway/gateway.go
+++ b/internal/services/gateway/gateway.go
@@ -137,15 +137,10 @@ func NewGateway(gc *config.Config) (*Gateway, error) {
 }
 
 func (g *Gateway) Run(ctx context.Context) error {
-	// noop coors handler
-	corsHandler := func(h http.Handler) http.Handler {
-		return h
-	}
-
 	corsAllowedMethodsOptions := ghandlers.AllowedMethods([]string{"GET", "HEAD", "POST", "PUT", "DELETE"})
 	corsAllowedHeadersOptions := ghandlers.AllowedHeaders([]string{"Accept", "Accept-Encoding", "Authorization", "Content-Length", "Content-Type", "X-CSRF-Token", "Authorization"})
 	corsAllowedOriginsOptions := ghandlers.AllowedOrigins([]string{"*"})
-	corsHandler = ghandlers.CORS(corsAllowedMethodsOptions, corsAllowedHeadersOptions, corsAllowedOriginsOptions)
+	corsHandler := ghandlers.CORS(corsAllowedMethodsOptions, corsAllowedHeadersOptions, corsAllowedOriginsOptions)
 
 	webhooksHandler := api.NewWebhooksHandler(logger, g.ah, g.configstoreClient, g.runserviceClient, g.c.APIExposedURL)
 
@@ -307,7 +302,7 @@ func (g *Gateway) Run(ctx context.Context) error {
 	router.Handle("/webhooks", webhooksHandler).Methods("POST")
 	router.PathPrefix("/").HandlerFunc(handlers.NewWebBundleHandlerFunc(g.c.APIExposedURL))
 
-	maxBytesHandler := handlers.NewMaxBytesHandler(router, 1024*1024)
+	maxBytesHandler := handlers.NewMaxBytesHandler(router, maxRequestSize)
 
 	mainrouter := mux.NewRouter()
 	mainrouter.PathPrefix("/repos/").Handler(corsHandler(reposRouter))
diff --git a/internal/services/gateway/handlers/auth.go b/internal/services/gateway/handlers/auth.go
index a94b9ce..6097288 100644
--- a/internal/services/gateway/handlers/auth.go
+++ b/internal/services/gateway/handlers/auth.go
@@ -150,7 +150,7 @@ func (h *AuthHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 func stripPrefixFromTokenString(prefix string) func(tok string) (string, error) {
 	return func(tok string) (string, error) {
 		pl := len(prefix)
-		if len(tok) > pl && strings.ToUpper(tok[0:pl+1]) == strings.ToUpper(prefix+" ") {
+		if len(tok) > pl && strings.EqualFold(tok[0:pl+1], prefix+" ") {
 			return tok[pl+1:], nil
 		}
 		return "", nil
@@ -161,20 +161,20 @@ func stripPrefixFromTokenString(prefix string) func(tok string) (string, error)
 // header
 // Uses PostExtractionFilter to strip "token " prefix from header
 var TokenExtractor = &jwtrequest.PostExtractionFilter{
-	jwtrequest.MultiExtractor{
+	Extractor: jwtrequest.MultiExtractor{
 		jwtrequest.HeaderExtractor{"Authorization"},
 		jwtrequest.ArgumentExtractor{"access_token"},
 	},
-	stripPrefixFromTokenString("token"),
+	Filter: stripPrefixFromTokenString("token"),
 }
 
 // BearerTokenExtractor extracts a bearer token in format "bearer THETOKEN" from
 // Authorization header
 // Uses PostExtractionFilter to strip "Bearer " prefix from header
 var BearerTokenExtractor = &jwtrequest.PostExtractionFilter{
-	jwtrequest.MultiExtractor{
+	Extractor: jwtrequest.MultiExtractor{
 		jwtrequest.HeaderExtractor{"Authorization"},
 		jwtrequest.ArgumentExtractor{"access_token"},
 	},
-	stripPrefixFromTokenString("bearer"),
+	Filter: stripPrefixFromTokenString("bearer"),
 }
diff --git a/internal/services/gateway/handlers/webbundle.go b/internal/services/gateway/handlers/webbundle.go
index 5dc490b..54a7321 100644
--- a/internal/services/gateway/handlers/webbundle.go
+++ b/internal/services/gateway/handlers/webbundle.go
@@ -51,7 +51,9 @@ func NewWebBundleHandlerFunc(gatewayURL string) func(w http.ResponseWriter, r *h
 		gatewayURL,
 		"/api/v1alpha",
 	}
-	configTpl.Execute(&buf, configTplData)
+	if err := configTpl.Execute(&buf, configTplData); err != nil {
+		panic(err)
+	}
 
 	config := buf.Bytes()