Gosec + servasec
Go static analysis tool that inspects source code for security problems.
What is Gosec?
Gosec is a static analysis tool for Go source code that inspects the AST for security problems. It checks for issues like hardcoded credentials, SQL injection, directory traversal, and insecure use of cryptographic functions. Gosec is the standard SAST tool for Go projects and produces JSON output compatible with servasec ingestion.
Go-specific AST analysisBuilt-in rule set for Go securitySuppression comments supportedConfidence and severity levelsCI/CD friendly output
Integrate Gosec with servasec
1
Install Gosec
Install Gosec via Go.
go install github.com/securego/gosec/v2/cmd/gosec@latest
2
Run a scan
Run Gosec against your Go project.
gosec -fmt=json -out=results.json ./...
3
Push to servasec
Send the results to servasec.
curl -X POST "$SSC_PUBLIC_URL/api/ingest" \ -H "X-Api-Token: $API_TOKEN" \ -F "[email protected]"
What servasec adds to Gosec
Cross-language correlation
See Go findings alongside Python, JavaScript, and other languages.
Severity trending
Track Gosec findings across releases to measure improvement.
Remediation tracking
Assign Go-specific findings to developers with due dates.