gosec

gosec ./...

Scans Go code with gosec, detecting language security issues (injections, weak crypto, permissions, SSRF).

Run it in the pipeline of Go projects when you want static security analysis: gosec analyzes packages and reports findings with severity and CWE — command execution, weak crypto, file permissions, SQL injection, SSRF (URLs from input), hardcoded credentials. It's the reference SAST for Go: fast and with language rules. In Go DevSecOps, gosec is the pipeline filter: high-severity findings block the merge.

Don't use it as a complete analysis: gosec detects patterns from its rules — logic vulnerabilities and dependencies (SCA) are out of scope. Findings are triaged (false positives with #nosec). And note: gosec analyzes source code — runtime behavior (DAST) and deep semantic analysis (CodeQL) complement it. Keep the version up to date (new rules). For the pipeline, JSON output integrates with other checks.