diff --git a/caddyfile.go b/caddyfile.go
index 4124d11..e426e61 100644
--- a/caddyfile.go
+++ b/caddyfile.go
@@ -5,7 +5,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/caddyserver/caddy/v2"
+	caddy "github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
 	"github.com/caddyserver/caddy/v2/caddyconfig/httpcaddyfile"
 	"github.com/caddyserver/caddy/v2/modules/caddyhttp"
diff --git a/forwardproxy.go b/forwardproxy.go
index 6a5d107..136dcc6 100644
--- a/forwardproxy.go
+++ b/forwardproxy.go
@@ -30,12 +30,13 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"path/filepath"
 	"strconv"
 	"strings"
 	"sync"
 	"time"
 
-	"github.com/caddyserver/caddy/v2"
+	caddy "github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
 	"github.com/caddyserver/caddy/v2/modules/caddyhttp"
 	"github.com/caddyserver/forwardproxy/httpclient"
@@ -197,7 +198,7 @@ func (h *Handler) Provision(ctx caddy.Context) error {
 				// either way, it's impossible to have a legit TLS certificate for "127.0.0.1" - TODO: not true anymore
 				h.logger.Info("Localhost upstream detected, disabling verification of TLS certificate")
 				d.DialTLS = func(network string, address string) (net.Conn, string, error) {
-					conn, err := tls.Dial(network, address, &tls.Config{InsecureSkipVerify: true})
+					conn, err := tls.Dial(network, address, &tls.Config{InsecureSkipVerify: true}) // #nosec G402
 					if err != nil {
 						return nil, "", err
 					}
@@ -393,7 +394,7 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyht
 				fmt.Errorf("failed to read upstream response: %v", err))
 		}
 	}
-	r.Body.Close()
+	err = r.Body.Close()
 
 	if response != nil {
 		defer response.Body.Close()
@@ -547,10 +548,10 @@ func serveHiddenPage(w http.ResponseWriter, authErr error) error {
 	if authErr != nil {
 		w.Header().Set("Proxy-Authenticate", "Basic realm=\"Caddy Secure Web Proxy\"")
 		w.WriteHeader(http.StatusProxyAuthRequired)
-		w.Write([]byte(fmt.Sprintf(hiddenPage, AuthFail)))
+		_, _ = w.Write([]byte(fmt.Sprintf(hiddenPage, AuthFail)))
 		return authErr
 	}
-	w.Write([]byte(fmt.Sprintf(hiddenPage, AuthOk)))
+	_, _ = w.Write([]byte(fmt.Sprintf(hiddenPage, AuthOk)))
 	return nil
 }
 
@@ -576,7 +577,8 @@ func serveHijack(w http.ResponseWriter, targetConn net.Conn) error {
 			if err != nil {
 				return caddyhttp.Error(http.StatusBadGateway, err)
 			}
-			targetConn.Write(rbuf)
+			_, _ = targetConn.Write(rbuf)
+
 		}
 	}
 	// Since we hijacked the connection, we lost the ability to write and flush headers via w.
@@ -615,8 +617,9 @@ func dualStream(target net.Conn, clientReader io.ReadCloser, clientWriter io.Wri
 		buf = buf[0:cap(buf)]
 		_, _err := flushingIoCopy(w, r, buf)
 		bufferPool.Put(buf)
+
 		if cw, ok := w.(closeWriter); ok {
-			cw.CloseWrite()
+			_ = cw.CloseWrite()
 		}
 		return _err
 	}
@@ -736,7 +739,8 @@ type ProbeResistance struct {
 }
 
 func readLinesFromFile(filename string) ([]string, error) {
-	file, err := os.Open(filename)
+	cleanFilename := filepath.Clean(filename)
+	file, err := os.Open(cleanFilename)
 	if err != nil {
 		return nil, err
 	}
diff --git a/httpclient/httpclient.go b/httpclient/httpclient.go
index a90293a..ad77f88 100644
--- a/httpclient/httpclient.go
+++ b/httpclient/httpclient.go
@@ -132,12 +132,12 @@ func (c *HTTPConnectDialer) DialContext(ctx context.Context, network, address st
 
 		resp, err := h2clientConn.RoundTrip(req)
 		if err != nil {
-			rawConn.Close()
+			err = rawConn.Close()
 			return nil, err
 		}
 
 		if resp.StatusCode != http.StatusOK {
-			rawConn.Close()
+			_ = rawConn.Close()
 			return nil, errors.New("Proxy responded with non 200 code: " + resp.Status)
 		}
 		return NewHttp2Conn(rawConn, pw, resp.Body), nil
@@ -150,18 +150,18 @@ func (c *HTTPConnectDialer) DialContext(ctx context.Context, network, address st
 
 		err := req.Write(rawConn)
 		if err != nil {
-			rawConn.Close()
+			err = rawConn.Close()
 			return nil, err
 		}
 
 		resp, err := http.ReadResponse(bufio.NewReader(rawConn), req)
 		if err != nil {
-			rawConn.Close()
+			err = rawConn.Close()
 			return nil, err
 		}
 
 		if resp.StatusCode != http.StatusOK {
-			rawConn.Close()
+			_ = rawConn.Close()
 			return nil, errors.New("Proxy responded with non 200 code: " + resp.Status)
 		}
 		return rawConn, nil
@@ -207,6 +207,7 @@ func (c *HTTPConnectDialer) DialContext(ctx context.Context, network, address st
 			tlsConf := tls.Config{
 				NextProtos: []string{"h2", "http/1.1"},
 				ServerName: c.ProxyURL.Hostname(),
+				MinVersion: tls.VersionTLS12,
 			}
 			tlsConn, err := tls.Dial(network, c.ProxyURL.Host, &tlsConf)
 			if err != nil {
@@ -232,13 +233,13 @@ func (c *HTTPConnectDialer) DialContext(ctx context.Context, network, address st
 		t := http2.Transport{}
 		h2clientConn, err := t.NewClientConn(rawConn)
 		if err != nil {
-			rawConn.Close()
+			err = rawConn.Close()
 			return nil, err
 		}
 
 		proxyConn, err := connectHttp2(rawConn, h2clientConn)
 		if err != nil {
-			rawConn.Close()
+			err = rawConn.Close()
 			return nil, err
 		}
 		if c.EnableH2ConnReuse {
@@ -249,7 +250,7 @@ func (c *HTTPConnectDialer) DialContext(ctx context.Context, network, address st
 		}
 		return proxyConn, err
 	default:
-		rawConn.Close()
+		_ = rawConn.Close()
 		return nil, errors.New("negotiated unsupported application layer protocol: " +
 			negotiatedProtocol)
 	}
@@ -274,8 +275,13 @@ func (h *http2Conn) Write(p []byte) (n int, err error) {
 }
 
 func (h *http2Conn) Close() error {
-	h.in.Close()
-	return h.out.Close()
+	inErr := h.in.Close()
+	outErr := h.out.Close()
+
+	if inErr != nil {
+		return inErr
+	}
+	return outErr
 }
 
 func (h *http2Conn) CloseConn() error {