How do I suppress a finding or honor #nosec?

A #nosec comment on a flagged line suppresses that finding. Set -nosec-tag to use an alternate marker. Set -nosec to ignore every #nosec comment and report those lines anyway.

How do I focus a scan on specific rules?

Pass comma-separated rule ids to -include or -exclude (for example G101 or G201). Filter further with -severity and -confidence set to low, medium, or high.

What output formats does gosec support?

Set -fmt to json, yaml, csv, junit-xml, html, sonarqube, golint, sarif, or text (default text). SARIF and JUnit XML drop into CI code-scanning dashboards or a shared findings table.

How do I keep findings from failing the build?

Set -no-fail so gosec reports issues without a non-zero exit. gosec skips *_test.go by default; set -tests to include them.

How is gosec different from semgrep?

gosec is Go-specific and ships Go security rules keyed to the Go AST. semgrep matches patterns across many languages. Use gosec on Go repositories; reach for semgrep on polyglot codebases.

Updated Jul 14, 2026

Static Code Analysis

Scan Go source for security issues in the AST

Go AST security scanner for credentials, crypto, and injection.

Scan Go code for security bugs Gate a pipeline on findings Tune the ruleset to cut noise

overview

What gosec does

gosec is the Go-only Static Code Analysis step when the artifact is a repository, not a running service. It walks the Go AST and matches nodes against rules for hardcoded credentials, unsafe SQL, weak crypto, command injection, and unchecked errors.

Tune coverage with -include and -exclude rule ids. Filter the report with -severity and -confidence. Emit json, sarif, or junit-xml via -fmt for CI gates and shared findings tables.

Point the target folder at Go source and route the -fmt report into the same triage path as dynamic scanners. For polyglot codebases, prefer semgrep; gosec stays Go-specific.

source github.com/securego/gosec

use cases

Where gosec fits

Scan Go code for security bugs

Run gosec across a Go project's AST to surface hardcoded secrets, unsafe SQL, weak crypto, and command injection before the code ships.

Gate a pipeline on findings

Let gosec fail the workflow when issues appear, or set -no-fail to report without breaking the build while you triage the backlog.

Tune the ruleset to cut noise

Use -include and -exclude with rule ids, plus -severity and -confidence filters, so a run reports only the issue classes you care about.

Feed a unified findings table

Emit SARIF or JSON with -fmt so gosec results land in the same code-scanning and reporting flow as your dynamic scanner output for one view of risk.

reference

gosec inputs and flags

14 inputs

Name	Type	Flag	Description
target	FOLDER	·	Target directory of Go source to scan.
severity	STRING	-severity	Report only issues at or above this severity (low, medium, high).
confidence	STRING	-confidence	Report only issues at or above this confidence (low, medium, high).
output-format	STRING	-fmt	Output format: json, sarif, junit-xml, html, csv, sonarqube, golint, yaml, or text.
exclude	STRING	-exclude	Comma-separated rule ids to skip, e.g. G104,G304.
include	STRING	-include	Comma-separated rule ids to run exclusively.
nosec	BOOLEAN	-nosec	Ignore #nosec comments and report suppressed lines anyway.
no-fail	BOOLEAN	-no-fail	Report issues without failing the workflow's exit code.

Showing key inputs. gosec exposes 14 inputs in total.

Full flag reference (14 inputs)

Name	Type	Flag	Description
tags	STRING	-tags	Comma-separated list of build tags.
nosec	BOOLEAN	-nosec	Ignores #nosec comments when set.
quiet	BOOLEAN	-quiet	Only show output when errors are found.
tests	BOOLEAN	-tests	Scan test files.
target	FOLDER	·	Target directory to scan.
exclude	STRING	-exclude	Comma-separated list of rule ids to exclude (rule list on the tool's GitHub page).
include	STRING	-include	Comma-separated list of rule ids to include (rule list on the tool's GitHub page).
no-fail	BOOLEAN	-no-fail	Do not fail the scan even when issues are found.
severity	STRING	-severity	Filter out issues with a lower severity than the given value. Valid options: low, medium, high (default low).
nosec-tag	STRING	-nosec-tag	Set an alternative string for #nosec. Examples: #dontanalyze, #falsepositive.
confidence	STRING	-confidence	Filter out issues with a lower confidence than the given value. Valid options: low, medium, high (default low).
config-file	FILE	-conf	Optional config file.
exclude-dir	STRING	-exclude-dir	Exclude a folder from the scan (can be specified multiple times).
output-format	STRING	-fmt	Set output format. Valid options: json, yaml, csv, junit-xml, html, sonarqube, golint, sarif, or text (default text).

example

Run gosec

gosec · command

# scan a Go project, keep high-severity findings, write SARIFgosec -severity high -confidence medium -exclude G104 -fmt sarif ./...

sample output

[example.com/app/db/users.go:57] - G201 (CWE-89): SQL string formatting (Confidence: HIGH, Severity: MEDIUM)  > 57:   query := fmt.Sprintf("SELECT * FROM users WHERE id = %s", userID) [example.com/app/auth/token.go:23] - G101 (CWE-798): Potential hardcoded credentials (Confidence: LOW, Severity: HIGH)  > 23:   signingKey := "s3cr3t-signing-key-do-not-ship" Summary:  Files  : 214  Lines  : 41833  Issues : 9

guidance

Choosing gosec

Use gosec when you have Go source to analyze, not a running target. It is Go-specific. For other languages use a multi-language engine like semgrep. Pair it with dynamic scanners: gosec reasons about the code; a scanner tests the deployed app.

semgrep

Multi-language pattern-based analysis. gosec is Go-specific and ships Go security rules out of the box.

bandit

Python-only security linter. Same idea as gosec for a different language.

trivy

Scans images and code for vulnerabilities and misconfigurations. Broader scope than gosec Go-AST checks.

faq

gosec questions

Go source. It walks the Go AST and matches nodes against a ruleset for hardcoded credentials, unsafe SQL string building, weak crypto, command injection, and unchecked errors. It never executes the program.

Run gosec yourself

Go source feeds gosec, which scans the AST against its ruleset and writes the security findings as a queryable output.

Run gosec in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

target

FOLDER

Target directory of Go source to scan.

severity

STRING

-severity

Report only issues at or above this severity (low, medium, high).

confidence

STRING

-confidence

Report only issues at or above this confidence (low, medium, high).

output-format

STRING

-fmt

Output format: json, sarif, junit-xml, html, csv, sonarqube, golint, yaml, or text.

exclude

STRING

-exclude

Comma-separated rule ids to skip, e.g. G104,G304.

include

STRING

-include

Comma-separated rule ids to run exclusively.

nosec

BOOLEAN

-nosec

Ignore #nosec comments and report suppressed lines anyway.

no-fail

BOOLEAN

-no-fail

Report issues without failing the workflow's exit code.

Name

Type

Flag

Description

Scan Go source for security issues in the AST

What gosec does

Where gosec fits

Scan Go code for security bugs

Gate a pipeline on findings

Tune the ruleset to cut noise

Feed a unified findings table

gosec inputs and flags

Run gosec

Choosing gosec

semgrep

bandit

trivy

gosec questions

More Static Code Analysis tools

bandit

gitleaks

secretfinder

semgrep-scan

trufflehog

dawnscanner

Run gosec yourself

Scan Go source for security issues in the AST

What gosec does

Where gosec fits

Scan Go code for security bugs

Gate a pipeline on findings

Tune the ruleset to cut noise

Feed a unified findings table

gosec inputs and flags

Run gosec

Choosing gosec

semgrep

bandit

trivy

gosec questions

More Static Code Analysis tools

bandit

gitleaks

secretfinder

semgrep-scan

trufflehog

dawnscanner

Run gosec yourself