Repolode
Submit
securego

securego/gosec

A static analysis tool that scans Go source code for common security vulnerabilities and insecure coding patterns.

View on GitHubWebsite
Stars
9,000
Forks
731
Open issues
5
Last commit
4 days ago

What is it?

gosec inspects Go source code for security problems by walking the AST and SSA representations of the code. It ships with rule groups covering hardcoded credentials, unsafe API usage, weak cryptography and TLS settings, file permission and path handling, and blocklisted imports, each mapped to a CWE identifier.

Its taint analysis rules track data flow from user input into sensitive sinks, covering injection classes such as SQL, command, template and SMTP injection, along with SSRF, path traversal, XSS, open redirect and unsafe deserialization. Findings can be suppressed inline with #nosec or //gosec:disable comments, or filtered by rule, path, severity and confidence.

Results can be exported as text, JSON, YAML, CSV, JUnit XML, HTML, SonarQube, golint or SARIF, and the tool can run as a GitHub Action or be installed with go install.

Key features

  • 01Pattern-based rules for common Go security issues such as hardcoded credentials and weak crypto
  • 02Taint analysis tracking user input into SQL, command, path, SSRF and XSS sinks
  • 03Inline suppression with #nosec or //gosec:disable, with optional justification requirements
  • 04Path-based rule exclusions and severity and confidence filters
  • 05Multiple report formats including SARIF for GitHub code scanning

Use cases

  • Running security checks on Go code in CI pipelines via the GitHub Action
  • Uploading SARIF results to GitHub code scanning for pull request review
  • Auditing a Go codebase for injection, weak crypto or insecure TLS settings before release

Quick start

  1. 1

    Install gosec with go install (requires Go 1.25 or newer)

    go install github.com/securego/gosec/v2/cmd/gosec@latest
  2. 2

    Scan all packages in the current module

    gosec ./...

Things to know

  • Requires Go 1.25 or newer to install and build.

In collections

Security scanners, audits & threat intel tools

Topics

#golang#static-analysis#security-scanner#sast#taint-analysis#code-security#security#security-automation#security-tools#static-code-analysis

FAQ

What is gosec?
A static analysis tool that scans Go source code for common security vulnerabilities and insecure coding patterns. gosec inspects Go source code for security problems by walking the AST and SSA representations of the code. It ships with rule groups covering hardcoded credentials, unsafe API usage, weak cryptography and TLS settings, file permission and path handling, and blocklisted imports, each mapped to a CWE identifier.
Is gosec free to use? What license does it have?
gosec is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is gosec still maintained?
Actively maintained. The last commit to gosec was on Nov 3, 2026.
What can I use gosec for?
Running security checks on Go code in CI pipelines via the GitHub Action Uploading SARIF results to GitHub code scanning for pull request review Auditing a Go codebase for injection, weak crypto or insecure TLS settings before release
How do I install gosec?
Install gosec with go install (requires Go 1.25 or newer): go install github.com/securego/gosec/v2/cmd/gosec@latest Scan all packages in the current module: gosec ./...
Where can I get gosec?
The source code and installation instructions are on GitHub: https://github.com/securego/gosec

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects