dennisonbertram Go Security Scanner (gosec)
You are now operating in gosec security scanning mode.
Installation
go install github.com/securego/gosec/v2/cmd/gosec@latest
Basic Usage
# Scan all packages (default)
gosec ./...
# Scan a specific package
gosec ./internal/server/...
# JSON output for programmatic parsing
gosec -fmt json ./... 2>&1
# Show severity threshold (only HIGH and CRITICAL)
gosec -severity high ./...
# Exclude specific rules
gosec -exclude=G104 ./...
# Include only specific rules
gosec -include=G201,G202,G204 ./...
Interpreting Results
Results are reported with severity and confidence:
[/path/to/file.go:42] - G201 (CWE-89): SQL string formatting
Severity: HIGH Confidence: MEDIUM
> fmt.Sprintf("SELECT * FROM users WHERE id = %d", userID)
Severity Levels
- HIGH: Must fix before merge — injection risks, credential exposure, unsafe deserialization
- MEDIUM: Should fix — weak crypto, permission issues, potential misuse
- LOW: Review and decide — informational, may be false positives
Key Rules Reference
| Rule | CWE | Description | Fix |
|---|---|---|---|
| G101 | CWE-798 | Hardcoded credentials | Move to environment variables |
| G104 | CWE-703 | Unhandled errors | Always check returned errors |
| G201 | CWE-89 | SQL string formatting (injection) | Use parameterized queries |
| G202 | CWE-89 | SQL query with string concat | Use parameterized queries |
| G204 | CWE-78 | Subprocess launched with variable | Validate/sanitize exec.Command args |
| G301 | CWE-276 | Poor file permissions | Use 0o600 for sensitive files |
| G304 | CWE-22 | File path from user input | Validate/sanitize path traversal |
| G401 | CWE-326 | Weak cryptographic primitive (MD5) | Use SHA-256 or stronger |
| G402 | CWE-295 | TLS with InsecureSkipVerify | Remove InsecureSkipVerify |
| G403 | CWE-780 | RSA key too small | Use 2048-bit minimum |
| G501 | CWE-327 | Import of crypto/md5 | Use crypto/sha256 |
Common Fixes
G201/G202: SQL Injection
// WRONG
query := fmt.Sprintf("SELECT * FROM users WHERE id = %d", userID)
db.Query(query)
// CORRECT
db.Query("SELECT * FROM users WHERE id = ?", userID)
G204: Command Injection
// WRONG — user input directly in command
cmd := exec.Command("git", "clone", userProvidedURL)
// CORRECT — validate input before use
if !isValidURL(userProvidedURL) {
return fmt.Errorf("invalid URL: %q", userProvidedURL)
}
cmd := exec.Command("git", "clone", userProvidedURL)
G101: Hardcoded Credentials
// WRONG
const apiKey = "sk-abc123..."
// CORRECT
apiKey := os.Getenv("API_KEY")
if apiKey == "" {
return fmt.Errorf("API_KEY environment variable is required")
}
G104: Unhandled Errors
// WRONG
os.Remove(tmpFile)
// CORRECT
if err := os.Remove(tmpFile); err != nil {
log.Printf("warning: failed to remove temp file %s: %v", tmpFile, err)
}
Suppressing False Positives
When a finding is a confirmed false positive, suppress it with a comment:
// #nosec G104 -- Read-only file, error is intentionally ignored
f, _ := os.Open("/etc/hostname")
Document why it is a false positive. Do not suppress without justification.
CI Integration
Add to .github/workflows/security.yml:
- name: Run gosec
run: |
go install github.com/securego/gosec/v2/cmd/gosec@latest
gosec -fmt json ./... 2>&1 | tee gosec-report.json
# Fail on HIGH severity findings
gosec -severity high ./...