The scram implementation has no unittests and ignores parts of the RFC (eg: the m field is supposed to trigger an authentication failure). This should be replaced with a fuller (and better tested) implementation. https://github.com/xdg-go/scram might be a candidate.