TiloBox
Back to directory
gosec project preview
Developer ToolsAlternative to SonarQube GoAlternative to Snyk CodeAlternative to Veracode

gosec

Golang security checker that inspects source code by scanning the Go Abstract Syntax Tree (AST).

View on GitHub Visit website
LicenseApache-2.0
GitHub stars7.5k
Last commit1 weeks ago
Tags5 topics
Sql Injection DetectorGo Ast Security AuditGosec CliSecurityGolang Sast Scanner
Overview

Why consider gosec?

gosec is an open-source static application security testing (SAST) tool written in Go by the SecureGo team. gosec inspects Go source code AST nodes against predefined security rules, identifying hardcoded credentials, SQL injections, insecure cryptographic algorithms, and unhandled errors.

Guided learning

Learn gosec by building

Practical setup notes, real use cases, and copy-ready examples in one focused guide.

1 min read 2 sections
In this guide2 sections

Overview of gosec

gosec scans Go codebases for security vulnerabilities during continuous integration runs.

Quickstart

bash
1go install github.com/securego/gosec/v2/cmd/gosec@latest
2gosec ./...

gosec is licensed under the Apache License Version 2.0.

Related tools

More options with a similar category or technology profile.

diskus logo

diskus

Minimal, fast alternative to du -sh written in Rust using multi-threaded directory traversal.

peco logo

peco

Simplistic interactive filtering tool for Unix pipelines, process lists, and file trees.

Dapr CLI logo

Dapr CLI

Command-line tool for managing Dapr distributed application runtime environments and sidecars.

Freeze logo

Freeze

Generate beautiful image screenshots and SVGs of code snippets and terminal outputs.

gosec FAQs

gosec is listed as a Developer Tools tool on TiloBox. Review the overview, features, and official documentation on this page to decide whether it solves your specific workflow.

Start with the project's GitHub repository and official website for supported installation and deployment instructions. Test the setup with representative data or a small project before rolling it out more widely.

gosec is listed under the Apache-2.0 license. Read the complete license text and the project's notices before using, modifying, or distributing the software.

Production readiness depends on your requirements. Review maintenance activity, security practices, documentation, backup and upgrade procedures, and compatibility with your stack; then validate it in a non-production environment.

gosec is listed as an alternative to SonarQube Go. Compare the core workflow, deployment model, integrations, and licensing against your must-have requirements before switching.