gosec
Go security checker
Tech stack & purpose
gosec is a Go static analysis tool that inspects source code for security vulnerabilities by scanning the Go Abstract Syntax Tree (AST) and Static Single Assignment (SSA) form. The project identifies security issues across multiple categories, including general secure coding problems, injection risks, file handling vulnerabilities, cryptographic weaknesses, blocklisted imports, Go-specific correctness checks, and taint analysis for tracking data flow in attacks like SQL injection and command injection. Built in Go, gosec can be run as a command-line tool, integrated as a GitHub Action, or used with other analysis frameworks that support the standard Go analysis interface. The project is maintained by securego and licensed under the Apache License 2.0.
Community & reference links
Languages
Contributors (top 30 of 184)
- Cosmin Cojocar516 commits
- renovate[bot]236 commits · 0 followers
- Grant Murphy199 commits
- Matthieu MOREL37 commits
- Ravi Sastry Kadali24 commits
- Tim Kelsey24 commits
- oittaa22 commits
- Oleksandr Redko17 commits
- Jon McClintock16 commits
- Dimitar Banchev14 commits
- Renovate Bot14 commits
- Marc Brugger10 commits
- Ville Skyttä9 commits
- cosmincojocar8 commits
- kencrawford7 commits
- Wong Her Laang7 commits
- Eshani Parulekar6 commits
- Martin Vrachev6 commits
- Cedric Staub6 commits
- cschoenduve-splunk5 commits
- Sebastian Rühl5 commits
- dependabot[bot]5 commits · 0 followers
- Nanik5 commits
- kaiili4 commits
- Delon Wong Her Laang4 commits
- Hiroki Suezawa4 commits
- Mark Wolfe4 commits
- Yiwei Ding4 commits
- Chris Bandy3 commits
- nobishino3 commits
