README

gosec - Go Security Checker

Inspects source code for security problems by scanning the Go AST
and SSA code representation.



 Quick links

- GitHub Action
- Local installation
- Quick start
- Common usage patterns
- Selecting rules
- Output formats

 Features

- Pattern-based rules for detecting common security issues
  in Go code
- SSA-based analyzers for type conversions, slice bounds,
  and crypto issues
- Taint analysis for tracking data flow from user input to
  dangerous functions (SQL injection, command injection, path
  traversal, SSRF, XSS, log injection, SMTP injection, SSTI,
  unsafe deserialization, open redirect)

 License

Licensed under the Apache License, Version 2.0 (the "License").
You may not use this file except in compliance with the License.
You may obtain a copy of the License
here.

 Project status












 Installation

 GitHub Action

You can run gosec as a GitHub action as follows:

Use the versioned tag with @master which is pinned to the
latest stable release. This will provide a stable behavior.

yaml
name: Run Gosec
on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master
jobs:
  tests:
    runs-on: ubuntu-latest
    env:
      GO111MODULE: on
    steps:
      - name: Checkout Source
        uses: actions/checkout@v3
      - name: Run Gosec Security Scanner
        uses: securego/gosec@master
        with:
          args: ./...


 Scanning Projects with Private Modules

If your project imports private Go modules, you need to
configure authentication so that gosec can fetch the
dependencies. Set the following environment variables in
your workflow:

- GOPRIVATE: A comma-separated list of module path prefixes
  that should be considered private
  (e.g., github.com/your-org/).
- GITHUB_AUTHENTICATION_TOKEN: A GitHub token with read
  access to your private repositories.

yaml
name: Run Gosec
on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master
jobs:
  tests:
    runs-on: ubuntu-latest
    env:
      GO111MODULE: on
      GOPRIVATE: github.com/your-org/
      GITHUB_AUTHENTICATION_TOKEN: ${{ secrets.PRIVATE_REPO_TOKEN }}
    steps:
      - name: Checkout Source
        uses: actions/checkout@v3
      - name: Run Gosec Security Scanner
        uses: securego/gosec@v2
        with:
          args: ./...


 Integrating with code scanning

You can integrate third-party code analysis tools
with GitHub code scanning by uploading data as SARIF files.

The workflow shows an example of running the gosec as a step
in a GitHub action workflow which outputs the results.sarif
file. The workflow then uploads the results.sarif file to
GitHub using the upload-sarif action.

yaml
name: "Security Scan"

 Run workflow each time code is pushed to your repository and on a schedule.
 The scheduled workflow runs every at 00:00 on Sunday UTC time.
on:
  push:
  schedule:
  - cron: '0 0   0'

jobs:
  tests:
    runs-on: ubuntu-latest
    env:
      GO111MODULE: on
    steps: