8 files changed, 28 insertions, 8 deletions
diff --git a/git_hooks_handle_linux.go b/git_hooks_handle_linux.go
index 40ba1ac..36034f2 100644
--- a/git_hooks_handle_linux.go
+++ b/git_hooks_handle_linux.go
@@ -76,7 +76,7 @@ func hooksHandler(conn net.Conn) {
 
 	{
 		var ok bool
-		packPass, ok = packPasses.Load(string(cookie))
+		packPass, ok = packPasses.Load(bytesToString(cookie))
 		if !ok {
 			if _, err = conn.Write([]byte{1}); err != nil {
 				return
diff --git a/git_hooks_handle_other.go b/git_hooks_handle_other.go
index d4ee43a..02236c7 100644
--- a/git_hooks_handle_other.go
+++ b/git_hooks_handle_other.go
@@ -54,7 +54,7 @@ func hooksHandler(conn net.Conn) {
 
 	{
 		var ok bool
-		packPass, ok = packPasses.Load(string(cookie))
+		packPass, ok = packPasses.Load(bytesToString(cookie))
 		if !ok {
 			if _, err = conn.Write([]byte{1}); err != nil {
 				return
diff --git a/http_handle_repo_raw.go b/http_handle_repo_raw.go
index aab64b6..1b4181b 100644
--- a/http_handle_repo_raw.go
+++ b/http_handle_repo_raw.go
@@ -33,7 +33,7 @@ func httpHandleRepoRaw(writer http.ResponseWriter, request *http.Request, params
 	}
 	refHashSlice = refHash[:]
 
-	cacheHandle := append(refHashSlice, []byte(pathSpec)...) //nolint:gocritic
+	cacheHandle := append(refHashSlice, stringToBytes(pathSpec)...) //nolint:gocritic
 
 	if value, found := treeReadmeCache.Get(cacheHandle); found {
 		params["files"] = value.DisplayTree
diff --git a/http_handle_repo_tree.go b/http_handle_repo_tree.go
index 1bb9940..3c6e8df 100644
--- a/http_handle_repo_tree.go
+++ b/http_handle_repo_tree.go
@@ -39,7 +39,7 @@ func httpHandleRepoTree(writer http.ResponseWriter, request *http.Request, param
 	}
 	refHashSlice = refHash[:]
 
-	cacheHandle := append(refHashSlice, []byte(pathSpec)...) //nolint:gocritic
+	cacheHandle := append(refHashSlice, stringToBytes(pathSpec)...) //nolint:gocritic
 
 	if value, found := treeReadmeCache.Get(cacheHandle); found {
 		params["files"] = value.DisplayTree
diff --git a/readme_to_html.go b/readme_to_html.go
index a7c7cb6..9131207 100644
--- a/readme_to_html.go
+++ b/readme_to_html.go
@@ -37,7 +37,7 @@ func renderReadmeAtTree(tree *object.Tree) (readmeFilename string, readmeRendere
 			return "Error fetching README", escapeHTML("Unable to fetch contents of README: " + err.Error())
 		}
 
-		if err = markdownConverter.Convert([]byte(readmeFileContents), &readmeRenderedUnsafe); err != nil {
+		if err = markdownConverter.Convert(stringToBytes(readmeFileContents), &readmeRenderedUnsafe); err != nil {
 			return "Error fetching README", escapeHTML("Unable to render README: " + err.Error())
 		}
 
diff --git a/resources.go b/resources.go
index df992ba..6d32136 100644
--- a/resources.go
+++ b/resources.go
@@ -67,7 +67,7 @@ func loadTemplates() (err error) {
 				return err
 			}
 
-			_, err = templates.Parse(string(minified))
+			_, err = templates.Parse(bytesToString(minified))
 			if err != nil {
 				return err
 			}
diff --git a/ssh_server.go b/ssh_server.go
index 56ed501..8fc3918 100644
--- a/ssh_server.go
+++ b/ssh_server.go
@@ -36,7 +36,7 @@ func serveSSH(listener net.Listener) error {
 	}
 
 	serverPubkey = hostKey.PublicKey()
-	serverPubkeyString = string(goSSH.MarshalAuthorizedKey(serverPubkey))
+	serverPubkeyString = bytesToString(goSSH.MarshalAuthorizedKey(serverPubkey))
 	serverPubkeyFP = goSSH.FingerprintSHA256(serverPubkey)
 
 	server = &gliderSSH.Server{
@@ -44,7 +44,7 @@ func serveSSH(listener net.Listener) error {
 			clientPubkey := session.PublicKey()
 			var clientPubkeyStr string
 			if clientPubkey != nil {
-				clientPubkeyStr = strings.TrimSuffix(string(goSSH.MarshalAuthorizedKey(clientPubkey)), "\n")
+				clientPubkeyStr = strings.TrimSuffix(bytesToString(goSSH.MarshalAuthorizedKey(clientPubkey)), "\n")
 			}
 
 			clog.Info("Incoming SSH: " + session.RemoteAddr().String() + " " + clientPubkeyStr + " " + session.RawCommand())
diff --git a/unsafe.go b/unsafe.go
new file mode 100644
index 0000000..418a910
--- /dev/null
+++ b/unsafe.go
@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: BSD-2-Clause
+// SPDX-FileCopyrightText: Copyright (c) 2025 Runxi Yu <https://runxiyu.org>
+
+package main
+
+import "unsafe"
+
+// stringToBytes converts a string to a byte slice without copying the string.
+// Memory is borrowed from the string.
+// The resulting byte slice must not be modified in any form.
+func stringToBytes(s string) (bytes []byte) {
+	return unsafe.Slice(unsafe.StringData(s), len(s))
+}
+
+// bytesToString converts a byte slice to a string without copying the bytes.
+// Memory is borrowed from the byte slice.
+// The source byte slice must not be modified.
+func bytesToString(b []byte) string {
+	return unsafe.String(&b[0], len(b))
+}