gosec

What gosec is

gosec is a free security checker that scans Go source code for potential problems. It analyzes the abstract syntax tree and static single assignment representation, applying pattern-based rules, SSA analyzers, and taint analysis. Checks cover risks such as injection, path traversal, SSRF, and unsafe deserialization, alongside secure coding, file handling, crypto and TLS, blocklisted imports, and Go-specific rules. Each detected issue maps to a Common Weakness Enumeration entry. Users can select or exclude rules, set path-based exclusions, and adjust global settings such as audit mode. Reports can be produced as text, JSON, YAML, CSV, JUnit XML, HTML, SonarQube, golint, and SARIF. The project documents GitHub Actions use and SARIF uploads to GitHub code scanning; its goanalysis package supports compatible tools such as Bazel nogo. Local installation requires Go 1.25 or newer. An optional AI feature can suggest vulnerability fixes through listed providers or custom OpenAI-compatible APIs. Automated detection can produce false positives, which annotations can suppress when findings are verified safe.