gosec

gosec is an open-source static analysis tool that inspects Go source code for security problems by scanning the AST and SSA representations. It detects issues like hardcoded credentials, insecure random number generation, SQL injection, and weak cryptographic primitives, and includes taint analysis rules for tracking data flow from user input to dangerous functions.

Automated Go security scanning in CI/CD pipelines.

• +Maintained by the SecureGo organization, with rule groups for credentials, injection, file handling, crypto, and taint flows.
• +Ships a GitHub Action and a go/analysis analyzer for drivers such as Bazel nogo.
• +Configurable rules with support for suppressing false positives via annotations.

• +Focused on Go only; no cross-language support.
• +Rule set covers common patterns; taint rules cover a fixed list of sink categories.

Preventing insecure Go code patterns from entering production codebases.