$ show securego/gosec
gosec is a production-grade static analysis security scanner for Go source code. It analyzes Go programs by traversing the AST and SSA representations to detect a wide range of security vulnerabilities, including SQL injection, command injection, path traversal, cross-site scripting (XSS), hardcoded credentials, weak cryptography, TLS misconfigurations, and more. The tool is distributed as a CLI binary, a Docker image, a GitHub Action, and a reusable Go library. The architecture is modular: a core analysis engine loads Go packages, applies AST-based rules and SSA-based analyzers, and runs a configurable taint analysis engine that tracks data flow from user-controlled sources to dangerous sinks. Results are output in multiple formats (text, JSON, SARIF, CSV, JUnit, HTML, SonarQube, golint, YAML). The tool also integrates with AI providers (OpenAI, Claude, Gemini, Atlas) to suggest automated fixes for detected vulnerabilities. Notable design highlights include a generic LRU cache for regex matching, a path-based rule exclusion filter, a comprehensive CWE knowledge base, and a well-abstracted taint analysis configuration system. The codebase demonstrates strong engineering practices with extensive test coverage, performance benchmarks, and CI/CD pipelines for release and scanning.
The LLM identified 5 files worth highlighting for reuse:
Thread-safe LRU cache for compiled regex patterns. Provides a generic caching layer that compiles and caches regular expressions with bounded memory usage. The pattern is reusable in any Go project that needs efficient regex matching with automatic eviction of least-recently-used entries.
Generic LRU cache implementation with thread-safe operations. Provides a bounded cache with get/set/evict semantics. Can be extracted and reused in any Go application needing a simple, efficient caching layer.
Embedded MITRE CWE (Common Weakness Enumeration) database v4.4 as Go source data. Contains descriptions, names, and IDs for hundreds of weakness types. This is a valuable, self-contained data asset that can be reused by any security tool that needs to map vulnerabilities to CWE identifiers.
Path-based rule exclusion filter supporting CLI and config file rules, with Windows path normalization and merging of multiple rule sources. Demonstrates a well-designed filtering component that handles cross-platform path representations and provides a clean API for checking if a path matches any exclusion rule.
Conservative constant folding engine for Go AST that resolves expressions to their constant values where possible. Includes special handling for strings.Builder and bytes.Buffer content tracking. This is a non-trivial analysis component that demonstrates deep understanding of Go's type system and can be reused in any Go static analysis tool.