Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Static Code Analysis

Run gosec as a Trickest node on Go checkouts

gosec is an open-source Go security checker that inspects Go source code for security problems by analyzing the AST and SSA code representation, flagging findings such as SQL injection, weak cryptography, and unsafe file permissions as text, JSON, or SARIF.

installgo install github.com/securego/gosec/v2/cmd/gosec@latest

Go · Apache-2.0 license

Agent
Scan Go code for security bugsGate a pipeline on findingsTune the ruleset to cut noise

overview

What gosec does

gosec is the Go-only Static Code Analysis step when the artifact is a repository, not a running service. It walks the Go AST and matches nodes against rules for hardcoded credentials, unsafe SQL, weak crypto, command injection, and unchecked errors.

Tune coverage with -include and -exclude rule ids. Filter the report with -severity and -confidence. Emit json, sarif, or junit-xml via -fmt for CI gates and shared findings tables.

Point the target folder at Go source and route the -fmt report into the same triage path as dynamic scanners. For polyglot codebases, prefer semgrep; gosec stays Go-specific.

source github.com/securego/gosec

use cases

Where gosec fits

Scan Go code for security bugs

Run gosec across a Go project's AST to surface hardcoded secrets, unsafe SQL, weak crypto, and command injection before the code ships.

Gate a pipeline on findings

Let gosec fail the workflow when issues appear, or set -no-fail to report without breaking the build while you triage the backlog.

Tune the ruleset to cut noise

Use -include and -exclude with rule ids, plus -severity and -confidence filters, so a run reports only the issue classes you care about.

Feed a unified findings table

Emit SARIF or JSON with -fmt so gosec results land in the same code-scanning and reporting flow as your dynamic scanner output for one view of risk.

reference

gosec inputs and flags

14 inputs
NameTypeFlagDescription
targetFOLDER·Target directory of Go source to scan.
severitySTRING-severityReport only issues at or above this severity (low, medium, high).
confidenceSTRING-confidenceReport only issues at or above this confidence (low, medium, high).
output-formatSTRING-fmtOutput format: json, sarif, junit-xml, html, csv, sonarqube, golint, yaml, or text.
excludeSTRING-excludeComma-separated rule ids to skip, e.g. G104,G304.
includeSTRING-includeComma-separated rule ids to run exclusively.
nosecBOOLEAN-nosecIgnore #nosec comments and report suppressed lines anyway.
no-failBOOLEAN-no-failReport issues without failing the workflow's exit code.

Showing key inputs. gosec exposes 14 inputs in total.

Full flag reference (14 inputs)
NameTypeFlagDescription
tagsSTRING-tagsComma-separated list of build tags.
nosecBOOLEAN-nosecIgnores #nosec comments when set.
quietBOOLEAN-quietOnly show output when errors are found.
testsBOOLEAN-testsScan test files.
targetFOLDER·Target directory to scan.
excludeSTRING-excludeComma-separated list of rule ids to exclude (rule list on the tool's GitHub page).
includeSTRING-includeComma-separated list of rule ids to include (rule list on the tool's GitHub page).
no-failBOOLEAN-no-failDo not fail the scan even when issues are found.
severitySTRING-severityFilter out issues with a lower severity than the given value. Valid options: low, medium, high (default low).
nosec-tagSTRING-nosec-tagSet an alternative string for #nosec. Examples: #dontanalyze, #falsepositive.
confidenceSTRING-confidenceFilter out issues with a lower confidence than the given value. Valid options: low, medium, high (default low).
config-fileFILE-confOptional config file.
exclude-dirSTRING-exclude-dirExclude a folder from the scan (can be specified multiple times).
output-formatSTRING-fmtSet output format. Valid options: json, yaml, csv, junit-xml, html, sonarqube, golint, sarif, or text (default text).

example

Run gosec

gosec · command
# scan a Go project, keep high-severity findings, write SARIF
gosec -severity high -confidence medium -exclude G104 -fmt sarif ./...
sample output
[example.com/app/db/users.go:57] - G201 (CWE-89): SQL string formatting (Confidence: HIGH, Severity: MEDIUM)
  > 57:   query := fmt.Sprintf("SELECT * FROM users WHERE id = %s", userID)

[example.com/app/auth/token.go:23] - G101 (CWE-798): Potential hardcoded credentials (Confidence: LOW, Severity: HIGH)
  > 23:   signingKey := "s3cr3t-signing-key-do-not-ship"

Summary:
  Files  : 214
  Lines  : 41833
  Issues : 9

guidance

Choosing gosec

Use gosec when you have Go source to analyze, not a running target. It is Go-specific. For other languages use a multi-language engine like semgrep. Pair it with dynamic scanners: gosec reasons about the code; a scanner tests the deployed app.

semgrep

Multi-language pattern-based analysis. gosec is Go-specific and ships Go security rules out of the box.

bandit

Python-only security linter. Same idea as gosec for a different language.

trivy

Scans images and code for vulnerabilities and misconfigurations. Broader scope than gosec Go-AST checks.

faq

gosec questions

Go source. It walks the Go AST and matches nodes against a ruleset for hardcoded credentials, unsafe SQL string building, weak crypto, command injection, and unchecked errors. It never executes the program.

A #nosec comment on a flagged line suppresses that finding. Set -nosec-tag to use an alternate marker. Set -nosec to ignore every #nosec comment and report those lines anyway.

Pass comma-separated rule ids to -include or -exclude (for example G101 or G201). Filter further with -severity and -confidence set to low, medium, or high.

Set -fmt to json, yaml, csv, junit-xml, html, sonarqube, golint, sarif, or text (default text). SARIF and JUnit XML drop into CI code-scanning dashboards or a shared findings table.

Set -no-fail so gosec reports issues without a non-zero exit. gosec skips *_test.go by default; set -tests to include them.

gosec is Go-specific and ships Go security rules keyed to the Go AST. semgrep matches patterns across many languages. Use gosec on Go repositories; reach for semgrep on polyglot codebases.

related

More Static Code Analysis tools

  1. bandit

    Python source in, JSON security findings out.

  2. gitleaks

    Detect hardcoded secrets in git repos and plain directories.

  3. guarddog

    A package coordinate in, indicator hits out.

  4. malcontent-scan

    A package coordinate in, behavior findings out.

  5. osv-malicious

    A package coordinate in, malware advisory rows out.

  6. osv-scanner

    A lockfile in, advisory rows out.

Run gosec yourself

Go source feeds gosec, which scans the AST against its ruleset and writes the security findings as a queryable output.

Run gosec in TrickestBrowse the library

Facts on this page come from the live Trickest tool library.