gosec
What it is
gosec is a free security checker that scans Go source code using its abstract syntax tree and static single assignment representation. It uses pattern-based rules, SSA analyzers and taint analysis to flag risks such as injection, path traversal, server-side request forgery and unsafe deserialization. Its checks also cover secure coding, file and path handling, cryptography and TLS, blocklisted imports and Go-specific issues. Each detected issue maps to a Common Weakness Enumeration entry.
Users can select or exclude rules, set path-based exclusions and adjust global settings such as audit mode. Reports can be produced as text, JSON, YAML, CSV, JUnit XML, HTML, SonarQube, golint or SARIF. The project documents GitHub Actions use and SARIF uploads to GitHub code scanning; its goanalysis package supports compatible tools such as Bazel nogo. Local installation requires Go 1.25 or newer. Dependencies are loaded using Go modules and resolved automatically in most projects. An optional AI feature can suggest vulnerability fixes through listed providers or custom OpenAI-compatible APIs. Automated detection can produce false positives, which can be suppressed with code annotations when findings are verified safe.
For and against
For
- Maps every detected issue to a CWE entry.
- Supports SARIF and GitHub Actions workflows.
- Rules and path-based exclusions are configurable.
- Licensed under Apache License 2.0.
Against
- Local installation requires Go 1.25 or newer.
- Automated detection can produce false positives.
- AI fix suggestions require calling an AI API.
The verdict
gosec provides configurable Go security checks and several report formats, including options for CI integration. Users should account for the Go version requirement and review findings for false positives.
Who it suits
gosec suits developers and teams scanning Go source code, including those integrating results into CI workflows. Its rule selection and exclusion options can help tailor checks to a project.
Plans and prices
gosec
Open source Go security checker · Apache License 2.0
Read 7 Oct 2026 · github.com
On the record
- AI providers
- Documented providers include Atlas Cloud, Gemini, Claude, OpenAI and arbitrary OpenAI-compatible endpoints such as Azure OpenAI, LocalAI and Ollama.github.com · read 21 Oct 2026
- AI remediation
- An optional autofix mode calls an AI API to suggest fixes for findings.github.com · read 21 Oct 2026
- AI suggestions
- An optional feature can suggest vulnerability fixes by calling an AI API, with providers including Atlas Cloud, Gemini, Claude, OpenAI, and custom OpenAI-compatible APIs.github.com · read 7 Oct 2026
- Bazel integration
- The goanalysis package exposes a golang.org/x/tools/go/analysis Analyzer usable by Bazel nogo.github.com · read 21 Oct 2026
- CI integration
- The project supplies an official GitHub Action for scanning repositories in workflows.github.com · read 21 Oct 2026
- Community
- The Secure Go site links to project guidelines, tools, a community Slack, Stack Overflow, and a blog.securego.io · read 7 Oct 2026
- Configuration
- A JSON configuration file supports global settings such as audit mode and suppression behavior.github.com · read 21 Oct 2026
- CWE mapping
- Each detected issue is mapped to a Common Weakness Enumeration identifier.github.com · read 21 Oct 2026
- Dependencies
- gosec loads packages using Go modules and says dependencies are resolved automatically in most projects.github.com · read 7 Oct 2026
- Detection
- It includes pattern-based rules, SSA analyzers, and taint analysis for risks such as injection, path traversal, SSRF, and unsafe deserialization.github.com · read 7 Oct 2026
- Documentation depth
- Secure Go publishes per-rule guidance pages and links to API reference, Stack Overflow and Slack support channels.securego.io · read 21 Oct 2026
- Exit behavior
- Exit code 0 means no unsuppressed findings or processing errors; code 1 indicates at least one finding or processing error, while -no-fail forces 0.github.com · read 21 Oct 2026
- False positives
- The documentation says automated detection can produce false positives and supports code annotations to suppress verified safe findings.github.com · read 7 Oct 2026
- GitHub code scanning
- SARIF results can be uploaded through GitHub's upload-sarif action for code-scanning findings.github.com · read 21 Oct 2026
- Independent description
- DEV.co describes gosec as a Go static analyzer using pattern matching, control-flow analysis and taint tracking with SARIF support.dev.co · read 21 Oct 2026
- Independent feature summary
- AppSec Santa reports more than 50 CWE-mapped rules covering credentials, injection, cryptography, filesystem, network and memory issues.appsecsanta.com · read 21 Oct 2026
- Independent installation example
- Google's Secure Source Code codelab installs gosec 2.15.0 with the project's install script and runs it with a policy file.codelabs.developers.google.com · read 21 Oct 2026
- Independent praise: deployment
- AppSec Santa praises that the core scanner runs locally through Go modules without a hosted control plane or build server.appsecsanta.com · read 21 Oct 2026
