A static analysis tool that scans Go source code for security vulnerabilities by analyzing the AST and SSA representations.
gosec is a static application security testing (SAST) tool specifically designed for the Go programming language. It scans Go source code to identify security vulnerabilities by analyzing both the Abstract Syntax Tree and Static Single Assignment representations, helping developers catch issues like injection flaws, insecure configurations, and cryptographic weaknesses during development.
Go developers, security engineers, and DevOps teams who need to integrate security scanning into their Go development pipelines and CI/CD workflows.
Developers choose gosec because it provides Go-specific security analysis with taint tracking capabilities, supports multiple output formats for CI integration, and offers flexible configuration options while being maintained as a dedicated open-source project focused exclusively on Go security.
Go security checker
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Includes over 70 rules across categories like injection, crypto, and file handling, with detailed CWE mappings, as documented in RULES.md.
Tracks data flow from user input to dangerous functions to detect SQL injection, XSS, and other injection vulnerabilities, using Go's SSA representation.
Supports multiple output formats (JSON, SARIF, SonarQube) and has a dedicated GitHub Action, enabling seamless pipeline integration and code scanning uploads.
Can call AI APIs like Gemini and OpenAI to generate code fix recommendations for vulnerabilities, though it requires external API keys and configuration.
The README admits frequent false positives with #nosec annotations, forcing developers to manually verify and suppress issues, which can be time-consuming.
AI fix suggestions rely on third-party APIs (Gemini, Claude, OpenAI), adding cost, privacy concerns, and complexity with API key management and network calls.
Path-based exclusions and rule selections require regex patterns and detailed JSON configs, which can be error-prone and hard to maintain in evolving codebases.