gosec is a production-grade static analysis security scanner for Go source code. It analyzes Go programs by traversing the AST and SSA representations to detect a wide range of security vulnerabilities, including SQL injection, command injection, path traversal, cross-site scripting (XSS), hardcoded credentials, weak cryptography, TLS misconfigurations, and more. The tool is distributed as a CLI binary, a Docker image, a GitHub Action, and a reusable Go library. The architecture is modular: a core analysis engine loads Go packages, applies AST-based rules and SSA-based analyzers, and runs a configurable taint analysis engine that tracks data flow from user-controlled sources to dangerous sinks. Results are output in multiple formats (text, JSON, SARIF, CSV, JUnit, HTML, SonarQube, golint, YAML). The tool also integrates with AI providers (OpenAI, Claude, Gemini, Atlas) to suggest automated fixes for detected vulnerabilities. Notable design highlights include a generic LRU cache for regex matching, a path-based rule exclusion filter, a comprehensive CWE knowledge base, and a well-abstracted taint analysis configuration system. The codebase demonstrates strong engineering practices with extensive test coverage, performance benchmarks, and CI/CD pipelines for release and scanning.
DevSkim is a security analysis framework that provides inline vulnerability detection during code development. It consists of a core .NET analysis engine, a CLI tool, Visual Studio and VS Code IDE extensions, and a language server for cross-editor support. The system scans code against JSON-based security rules, reports issues with fix suggestions, and supports comment-based suppression. Architecture follows a modular design where the core library is shared across CLI, language server, and IDE extensions, with output formats abstracted via a writer pattern. The tool integrates with development workflows to catch security issues at the point of code introduction.