gosec
7.2#5 in static analysis toolsFree planFree planAPILinuxmacOSSelf-hosted
Visitgosec vs Semgrep Code
Semgrep Code
8.3#1 in sast toolsFrom $15 a monthFree planWebAPIExtensionLinux
VisitWhat both publish
| Fact | gosec | Semgrep Code |
|---|---|---|
| Detection | It includes pattern-based rules, SSA analyzers, and taint analysis for risks such as injection, path traversal, SSRF, and unsafe deserialization. | Its multimodal detection combines deterministic SAST for issues such as XSS and SQL injection with AI analysis for complex flaws such as IDOR and business logic vulnerabilities. |
| Documentation depth | Secure Go publishes per-rule guidance pages and links to API reference, Stack Overflow and Slack support channels. | Documentation covers scanning, rule writing, CLI commands, APIs, integrations, billing, support and release notes, with community Slack and GitHub issue support. |
| Open-source licence | The repository is licensed under the Apache License 2.0. | The Semgrep OSS engine is open source under the GNU LGPL 2.1; Semgrep-maintained rules use a separate Semgrep Rules License restricting redistribution and competing or SaaS use. |
| Purpose | gosec inspects Go source code for security problems by scanning its AST and SSA code representation. | Semgrep Code is a static application security testing product that finds code vulnerabilities and helps developers fix them. |
gosec plans
- gosecFree
Semgrep Code plans
- Free EditionFree
- Teams Secrets$15 a month
- Teams — Code$30 a month
- Teams Code$30 a month
- Teams Supply Chain$30 a month
- EnterprisePriced on request
Pick gosec if…
gosec is for Go developers and teams who want source-code security checks in local workflows or CI. It also suits teams that need configurable rules and machine-readable reports.
Pick Semgrep Code if…
Semgrep Code suits development teams looking for source-code vulnerability scanning within pull request, IDE or CI workflows. The listed Free Edition is for teams within its repository and contributor limits; larger teams can consider the paid tiers.