gosec (Securego)

What it is

A Go security checker that scans the syntax tree and type information of a Go module and reports rule matches with a CWE reference. Rules cover SQL string building, command execution, unsafe file permissions, hardcoded credentials, and TLS settings.

What it helps with

- Finding risky patterns in Go services before release
- Failing CI builds on new high-severity findings
- Exporting SARIF results to code scanning dashboards

Who it's for

Go developers, platform teams, and application security engineers who review Go code.

Worth knowing

It is also available as a linter inside golangci-lint, which many Go projects already run. False positives can be suppressed per line with a nosec comment and a short reason.

Does it need the code to compile?
It works best on code that builds, since several rules rely on Go type information.

Is there an equivalent for Python?
Yes, Bandit plays the same role for Python, and in our view Semgrep is the better fit when a codebase mixes many languages.