How do I make gosec ignore a line, and can I change the #nosec tag?

gosec honors a #nosec comment on a flagged line to suppress that finding. Set -nosec-tag to swap that marker for your own string, such as #dontanalyze or #falsepositive. Set -nosec when you want gosec to ignore every #nosec comment and report those lines anyway.

Can I focus a scan on specific rules?

Yes. -include and -exclude take comma-separated rule ids, like G101 for hardcoded credentials or G201 for SQL string formatting, to control which checks run. Filter the report further with -severity and -confidence set to low, medium, or high.

Does gosec scan recursively?

The standard CLI takes the ./... path spec to walk every package. On this platform the recursive scan is not yet available, so point the target input at the directory you want analyzed. Recursive support is planned.

What output formats does gosec support?

Set -fmt to json, yaml, csv, junit-xml, html, sonarqube, golint, sarif, or text (default text). SARIF and JUnit XML drop straight into CI code-scanning dashboards or a shared findings table.

Should I scan test files, and how do I keep a run from failing the build?

gosec skips *_test.go by default; set -tests to include them. Set -no-fail so gosec reports issues without returning a non-zero exit that breaks the pipeline while you work through the backlog.

How is gosec different from a multi-language scanner like semgrep?

gosec is Go-specific and ships Go security rules keyed to the Go AST and standard library out of the box. semgrep matches patterns across many languages. Use gosec on Go repositories; reach for semgrep when one engine has to cover a polyglot codebase.

Updated Jul 14, 2026

Static Code Analysis

Scan Go source for security issues by walking the AST

Inspect Go source code for security problems by scanning the Go AST.

Scan Go code for security bugs Gate a pipeline on findings Tune the ruleset to cut noise

overview

What gosec does

gosec analyzes Go source by walking the abstract syntax tree and matching it against a ruleset for common security mistakes: hardcoded credentials, unsafe SQL string building, weak crypto, command injection, and unchecked errors. Because it reasons about parsed code instead of running it, it catches issues that never reach a test or a live target.

Every rule carries an id, so you dial coverage with -include and -exclude lists and filter the report by -severity and -confidence to keep a run focused on what matters. Output ships in many formats, including JSON, SARIF, and JUnit XML, which makes gosec straightforward to wire into a CI gate or a findings pipeline.

Reach for gosec when the artifact you have is a Go repository, not a running service. Inside a Trickest workflow it takes a target directory, emits the format you choose, and routes findings into the same triage path your dynamic scanners feed.

source github.com/securego/gosec

use cases

Where gosec fits

Scan Go code for security bugs

Run gosec across a Go project's AST to surface hardcoded secrets, unsafe SQL, weak crypto, and command injection before the code ships.

Gate a pipeline on findings

Let gosec fail the workflow when issues appear, or set -no-fail to report without breaking the build while you triage the backlog.

Tune the ruleset to cut noise

Use -include and -exclude with rule ids, plus -severity and -confidence filters, so a run reports only the issue classes you care about.

Feed a unified findings table

Emit SARIF or JSON with -fmt so gosec results land in the same code-scanning and reporting flow as your dynamic scanner output for one view of risk.

reference

gosec inputs and flags

14 inputs

Name	Type	Flag	Description
target	FOLDER	·	Target directory of Go source to scan.
severity	STRING	-severity	Report only issues at or above this severity (low, medium, high).
confidence	STRING	-confidence	Report only issues at or above this confidence (low, medium, high).
output-format	STRING	-fmt	Output format: json, sarif, junit-xml, html, csv, sonarqube, golint, yaml, or text.
exclude	STRING	-exclude	Comma-separated rule ids to skip, e.g. G104,G304.
include	STRING	-include	Comma-separated rule ids to run exclusively.
nosec	BOOLEAN	-nosec	Ignore #nosec comments and report suppressed lines anyway.
no-fail	BOOLEAN	-no-fail	Report issues without failing the workflow's exit code.

Showing key inputs. gosec exposes 14 inputs in total.

Full flag reference (14 inputs)

Name	Type	Flag	Description
tags	STRING	-tags	Comma-separated list of build tags.
nosec	BOOLEAN	-nosec	Ignores #nosec comments when set.
quiet	BOOLEAN	-quiet	Only show output when errors are found.
tests	BOOLEAN	-tests	Scan test files.
target	FOLDER	·	Target directory to scan.
exclude	STRING	-exclude	Comma-separated list of rule ids to exclude (rule list on the tool's GitHub page).
include	STRING	-include	Comma-separated list of rule ids to include (rule list on the tool's GitHub page).
no-fail	BOOLEAN	-no-fail	Do not fail the scan even when issues are found.
severity	STRING	-severity	Filter out issues with a lower severity than the given value. Valid options: low, medium, high (default low).
nosec-tag	STRING	-nosec-tag	Set an alternative string for #nosec. Examples: #dontanalyze, #falsepositive.
confidence	STRING	-confidence	Filter out issues with a lower confidence than the given value. Valid options: low, medium, high (default low).
config-file	FILE	-conf	Optional config file.
exclude-dir	STRING	-exclude-dir	Exclude a folder from the scan (can be specified multiple times).
output-format	STRING	-fmt	Set output format. Valid options: json, yaml, csv, junit-xml, html, sonarqube, golint, sarif, or text (default text).

example

Run gosec

gosec · command

# scan a Go project, keep high-severity findings, write SARIFgosec -severity high -confidence medium -exclude G104 -fmt sarif ./...

sample output

[example.com/app/db/users.go:57] - G201 (CWE-89): SQL string formatting (Confidence: HIGH, Severity: MEDIUM)  > 57:   query := fmt.Sprintf("SELECT * FROM users WHERE id = %s", userID) [example.com/app/auth/token.go:23] - G101 (CWE-798): Potential hardcoded credentials (Confidence: LOW, Severity: HIGH)  > 23:   signingKey := "s3cr3t-signing-key-do-not-ship" Summary:  Files  : 214  Lines  : 41833  Issues : 9

guidance

Choosing gosec

Use gosec when you have Go source to analyze, not a running target. It is Go-specific, so for other languages use a multi-language engine like semgrep. Pair static analysis with dynamic scanners: gosec reasons about the code, a scanner tests the deployed app.

semgrep

Multi-language pattern-based analysis. gosec is Go-specific and ships Go security rules out of the box.

bandit

Python-only security linter. Same idea as gosec for a different language.

trivy

Scans images and code for vulnerabilities and misconfigurations. Broader scope than gosec's Go-AST checks.

faq

gosec questions

Go source code. gosec is a Go static analysis (SAST) tool that walks the Go abstract syntax tree and matches nodes against a ruleset for hardcoded credentials, unsafe SQL string building, weak crypto, command injection, and unchecked errors. It reads the parsed code, so it never runs the program.

Run gosec yourself

Go source feeds gosec, which scans the AST against its ruleset and writes the security findings as a queryable output.

Run gosec in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

target

FOLDER

Target directory of Go source to scan.

severity

STRING

-severity

Report only issues at or above this severity (low, medium, high).

confidence

STRING

-confidence

Report only issues at or above this confidence (low, medium, high).

output-format

STRING

-fmt

Output format: json, sarif, junit-xml, html, csv, sonarqube, golint, yaml, or text.

exclude

STRING

-exclude

Comma-separated rule ids to skip, e.g. G104,G304.

include

STRING

-include

Comma-separated rule ids to run exclusively.

nosec

BOOLEAN

-nosec

Ignore #nosec comments and report suppressed lines anyway.

no-fail

BOOLEAN

-no-fail

Report issues without failing the workflow's exit code.

Name

Type

Flag

Description

Scan Go source for security issues by walking the AST

What gosec does

Where gosec fits

Scan Go code for security bugs

Gate a pipeline on findings

Tune the ruleset to cut noise

Feed a unified findings table

gosec inputs and flags

Run gosec

Choosing gosec

semgrep

bandit

trivy

gosec questions

More Static Code Analysis tools

bandit

dawnscanner

dumpsterdiver

dvcsripper-git

git-log4j

gitleaks

Run gosec yourself

Scan Go source for security issues by walking the AST

What gosec does

Where gosec fits

Scan Go code for security bugs

Gate a pipeline on findings

Tune the ruleset to cut noise

Feed a unified findings table

gosec inputs and flags

Run gosec

Choosing gosec

semgrep

bandit

trivy

gosec questions

More Static Code Analysis tools

bandit

dawnscanner

dumpsterdiver

dvcsripper-git

git-log4j

gitleaks

Run gosec yourself