gosec

Changelog

• 9e75c0576c9878035d4221392108d458abe10fc3 feat(G101): detect AWS temporary access keys (#1702)
• 14f493ab92f212e1f3d69aeaa561989e5baf9d6f Update to go version 1.26.5 and 1.25.12 (#1704)
• ffd5ba1d3354928fae89ac31912bd1d730798799 Update all dependencies (#1703)
• 849570622f56a251c015c0e2417aebafc0216e17 Update all dependencies (#1699)
• 11023e51e1f46c4ea63315bdb7670f073442168f Update all dependencies (#1698)
• f88a0781159d73052ba792962e624749904783d6 fix: min+max G115 false positives (#1697)
• 6a008f60b8f7f3d7fae8f126984a9df5d4b7e0cf Update all dependencies (#1696)
• caf8857bbd3276599d0176b0528e9712bb0b5bec fix(G404): flag missing math/rand weak-random functions (#1694)
• cbef395cb1e2e3a35f6223f5b97f1657f7144797 Update all dependencies (#1695)
• f1c81de5fcdf7b466b229fb24ca02d1a8406dd09 Update all dependencies (#1693)
• 9addc97cefc9460a114e3c36f536b935da3b98c9 Update to go version 1.26.4 and 1.25.11 (#1690)
• 92ed8df32846e85d4e81b0b62012567afddfdc95 Update the gosec in the Github action to v2.27.1 (#1688)

gosec - Go Security Checker

Inspects source code for security problems by scanning the Go AST

and SSA code representation.

<img src="https://securego.io/img/gosec.png" width="320">

Quick links

• GitHub Action
• Local installation
• Quick start
• Common usage patterns
• Selecting rules
• Output formats

Features

• Pattern-based rules for detecting common security issues

in Go code

• SSA-based analyzers for type conversions, slice bounds,

and crypto issues

• Taint analysis for tracking data flow from user input to

dangerous functions (SQL injection, command injection, path

traversal, SSRF, XSS, log injection, SMTP injection, SSTI,

unsafe deserialization, open redirect)

License

Licensed under the Apache License, Version 2.0 (the "License").

You may not use this file except in compliance with the License.

You may obtain a copy of the License

here.

Project status

CII Best Practices

Build Status

Coverage Status

GoReport

GoDoc

Docs

Downloads

GHCR

Slack

go-recipes

Installation

GitHub Action

You can run gosec as a GitHub action as follows:

Use the versioned tag with @master which is pinned to the

latest stable release. This will provide a stable behavior.

name: Run Gosec
on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master
jobs:
  tests:
    runs-on: ubuntu-latest
    env:
      GO111MODULE: on
    steps:
      - name: Checkout Source
        uses: actions/checkout@v3
      - name: Run Gosec Security Scanner
        uses: securego/gosec@master
        with:
          args: ./...

Scanning Projects with Private Modules

If your project imports private Go modules, you need to

configure authentication so that gosec can fetch the

dependencies. Set the following environment variables in

your workflow:

• GOPRIVATE: A comma-separated list of module path prefixes

that should be considered private

(e.g., github.com/your-org/*).

• GITHUB_AUTHENTICATION_TOKEN: A GitHub token with read

access to your private repositories.

name: Run Gosec
on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master
jobs:
  tests:
    runs-on: ubuntu-latest
    env:
      GO111MODULE: on
      GOPRIVATE: github.com/your-org/*
      GITHUB_AUTHENTICATION_TOKEN: ${{ secrets.PRIVATE_REPO_TOKEN }}
    steps:
      - name: Checkout Source
        uses: actions/checkout@v3
      - name: Run Gosec Security Scanner
        uses: securego/gosec@v2
        with:
          args: ./...

Integrating with code scanning

You can integrate third-party code analysis tools

with GitHub code scanning by uploading data as SARIF files.

The workflow shows an example of running the gosec as a step

in a GitHub action workflow which outputs the results.sarif

file. The workflow then uploads the results.sarif file to

GitHub using the upload-sarif action.

name: "Security Scan"

# Run workflow each time code is pushed to your repository and on a schedule.
# The scheduled workflow runs every at 00:00 on Sunday UTC time.
on:
  push:
  schedule:
  - cron: '0 0 * * 0'

jobs:
  tests:
    runs-on: ubuntu-latest
    env:
      GO111MODULE: on
    steps:
      - name: Checkout Source
        uses: actions/checkout@v3
      - name: Run Gosec Security Scanner
        uses: securego/gosec@v2
        with:
          # we let the report trigger content trigger a failure using the GitHub Security features.
          args: '-no-fail -fmt sarif -out results.sarif ./...'
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v2
        with:
          # Path to SARIF file relative to the root of the repository
          sarif_file: results.sarif

Go Analysis

The goanalysis package provides a

golang.org/x/tools/go/analysis.Analyzer

for integration with tools that support the standard Go

analysis interface, such as Bazel's

nogo

framework:

nogo(
    name = "nogo",
    deps = [
        "@com_github_securego_gosec_v2//goanalysis",
        # add more analyzers as needed
    ],
    visibility = ["//visibility:public"],
)

Local Installation

gosec requires Go 1.25 or newer.

go install github.com/securego/gosec/v2/cmd/gosec@latest

Quick start

# Scan all packages in current module
gosec ./...

# Write JSON report
gosec -fmt json -out results.json ./...

# Write SARIF report for code scanning
gosec -fmt sarif -out results.sarif ./...

Exit codes

• 0: scan finished without unsuppressed findings/errors
• 1: at least one unsuppressed finding or processing error
• Use -no-fail to always return 0

Usage

Gosec can be configured to only run a subset of rules, to

exclude certain file paths, and produce reports in different

formats. By default all rules will be run against the supplied

input files. To recursively scan from the current directory you

can supply ./... as the input argument.

Available rules

gosec includes rules across these categories:

• G1xx: general secure coding issues (for example hardcoded

credentials, unsafe usage, HTTP hardening, cookie security)

• G2xx: injection risks in query/template/command

construction

• G3xx: file and path handling risks (permissions, traversal,

temp files, archive extraction)

• G4xx: crypto and TLS weaknesses
• G5xx: blocklisted imports
• G6xx: Go-specific correctness/security checks (for example

range aliasing and slice bounds)

• G7xx: taint analysis rules (SQL injection, command

injection, path traversal, SSRF, XSS, log, SMTP injection,

SSTI, unsafe deserialization, and open redirect)

For the full list, rule descriptions, and per-rule

configuration, see RULES.md.

Retired rules

• G105: Audit the use of math/big.Int.Exp -

CVE is fixed

• G307: Deferring a method which returns an error - causing

more inconvenience than fixing a security issue, despite the

details from this

blog post

Selecting rules

By default, gosec will run all rules against the supplied file

paths. It is however possible to select a subset of rules to

run via the -include= flag, or to specify a set of rules to

explicitly exclude using the -exclude= flag.

# Run a specific set of rules
$ gosec -include=G101,G203,G401 ./...

# Run everything except for rule G303
$ gosec -exclude=G303 ./...

CWE Mapping

Every issue detected by gosec is mapped to a

CWE (Common Weakness Enumeration)

which describes in more generic terms the vulnerability. The

exact mapping can be found

here.

Configuration

A number of global settings can be provided in a configuration

file as follows:

{
    "global": {
        "nosec": "enabled",
        "audit": "enabled"
    }
}

• nosec: this setting will overwrite all #nosec directives

defined throughout the code base

• audit: runs in audit mode which enables addition checks

that for normal code analysis might be too nosy

# Run with a global configuration file
$ gosec -conf config.json .

Path-Based Rule Exclusions

Large repositories with multiple components may need different

security rules for different paths. Use exclude-rules to

suppress specific rules for specific paths.

Configuration File:

{
  "exclude-rules": [
    {
      "path": "cmd/.*",
      "rules": ["G204", "G304"]
    },
    {
      "path": "scripts/.*",
      "rules": ["*"]
    }
  ]
}

CLI Flag:

# Exclude G204 and G304 from cmd/ directory
gosec --exclude-rules="cmd/.*:G204,G304" ./...

# Exclude all rules from scripts/ directory
gosec --exclude-rules="scripts/.*:*" ./...

# Multiple exclusions
gosec --exclude-rules="cmd/.*:G204,G304;test/.*:G101" ./...

| Field | Type | Description |

|-------|------|-------------|

| path | string (regex) | Regex matched against file paths |

| rules | []string | Rule IDs to exclude. * for all |

Rule Configuration

Some rules accept configuration flags as well; these flags are

documented in

RULES.md.

Go version

Some rules require a specific Go version which is retrieved

from the Go module file present in the project. If this version

cannot be found, it will fallback to Go runtime version.

The Go module version is parsed using the go list command

which in some cases might lead to performance degradation. In

this situation, the go module version can be easily provided by

setting the environment variable

GOSECGOVERSION=go1.21.1.

Dependencies

gosec loads packages using Go modules. In most projects,

dependencies are resolved automatically during scanning.

If dependencies are missing, run:

go mod tidy
go mod download

Excluding test files and folders

gosec will ignore test files across all packages and any

dependencies in your vendor directory.

The scanning of test files can be enabled with the following

flag:

gosec -tests ./...

Also additional folders can be excluded as follows:

 gosec -exclude-dir=rules -exclude-dir=cmd ./...

Excluding generated files

gosec can ignore generated go files with default generated

code comment.

// Code generated by some generator DO NOT EDIT.

gosec -exclude-generated ./...

Auto fixing vulnerabilities

gosec can suggest fixes based on AI recommendation. It will

call an AI API to receive a suggestion for a security finding.

You can enable this feature by providing the following command

line arguments:

• ai-api-provider: the name of the AI API provider.

Supported providers:

• Atlas Cloud: atlas (default model

deepseek-ai/deepseek-v4-flash),

atlas-deepseek-v4-flash,

atlas-qwen3-coder-next, atlas-kimi-k2.6, or

atlas:<model-id> for any Atlas Cloud hosted chat model.

Atlas Cloud is an OpenAI-compatible provider available at

atlascloud.ai

• Gemini: gemini-3-pro-preview (default),

gemini-2.5-pro, gemini-2.5-flash,

gemini-2.5-flash-lite

• Claude: claude-sonnet-4-6 (default),

claude-opus-4-7, claude-opus-4-6,

claude-sonnet-4-5, claude-opus-4-5,

claude-haiku-4-5

• OpenAI: gpt-5.4 (default), gpt-5.4-mini,

gpt-5.4-nano

• Custom OpenAI-compatible: Any custom model name

(requires ai-base-url)

• ai-api-key or set the environment variable

GOSEC_AI_API_KEY: the key to access the AI API

• For Gemini, you can create an API key following

these instructions

• For Claude, get your API key from

Anthropic Console

• For OpenAI, get your API key from

OpenAI Platform

• ai-base-url: (optional) custom base URL for

OpenAI-compatible APIs (e.g., Azure OpenAI, LocalAI,

Ollama)

• Atlas Cloud uses https://api.atlascloud.ai/v1 by default,

so ai-base-url is optional for the built-in atlas

provider

• GOSEC_AI_PROVIDER: (optional) environment variable

alternative to ai-api-provider

• GOSEC_AI_BASE_URL: (optional) environment variable

alternative to ai-base-url

• ai-skip-ssl: (optional) skip SSL certificate verification

for AI API (useful for self-signed certificates)

🎁 Atlas Cloud is a full-modal AI inference platform that gives developers a single AI API to access video generation, image generation, and LLM APIs. Instead of managing multiple vendor integrations, you connect once and get unified access to 300+ curated models across all modalities.

Check out Atlas Cloud's new coding plan promotion for more budget-friendly API access: https://www.atlascloud.ai/console/coding-plan

Examples:

# Using Atlas Cloud with the default DeepSeek V4 Flash model
export GOSEC_AI_API_KEY="your_key"
export GOSEC_AI_PROVIDER="atlas"
gosec ./...

# Using Atlas Cloud with an explicit hosted mode