CheckOps home

Tools directory

G

CheckOps

gosec

gosec is an Apache-2.0 Go security checker that inspects source code for security problems by scanning the Go AST and SSA representation.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

gosec inspects Go source code for security problems by scanning the Go AST and SSA code representation. It ships a set of rules for issues such as hard-coded credentials, SQL string building, weak crypto and unsafe file permissions.

The source code is at securego/gosec on GitHub under the Apache-2.0 licence, with about 9,000 stars; the most recent commit was on 9 November 2026.

Features

  1. Go rules: Rules for common Go security issues.
  2. SSA analysis: Uses SSA for some checks.
  3. Rule selection: Include or exclude rules.
  4. Output formats: JSON, SARIF, JUnit and others.
  5. GitHub Action: Run in GitHub workflows.

Pros

  1. Free to use: Open source under Apache-2.0.
  2. Maintained: Commits as recent as 9 November 2026.
  3. Community: About 9,000 GitHub stars.

Cons

  1. Go only: Single language.
  2. False positives: Some rules need tuning with #nosec and reasons.
go install github.com/securego/gosec/v2/cmd/gosec@latest
gosec ./...

Resources:

Pricing

gosec is free and open source under the Apache-2.0 licence.

  1. Go teams adding SAST to CI.
  2. Reviewers catching common Go mistakes.
  3. Not a fit for dependency vulnerabilities; use govulncheck.

Conclusion

gosec is the standard open-source security linter for Go.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with gosec side by side.