Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

gosec

Free#22 of 26 in SAST ToolsStatic Application Security Testing SoftwareStatic Application Security Testing SastStatic Analysis Tools

gosec: A focused, free SAST tool for Go with CI workflows, taint analysis, and flexible reporting. Ranked #22 of 26 in SAST Tools by our editors (6.9/10); pricing: Free plan; best for go teams needing free security analysis.

6.9/10Editor score
Visit Gosec
gosec6.9 Visit Gosec

At a glance

  • Editor score
    6.9 / 10
  • Pricing
    Free plan
  • Best for
    Go teams needing free security analysis
  • Free plan
    Yes
  • Paid from
    Free
  • Pull request scans
    Yes
  • Facts checked
    21 Sep 2026
gosec screenshot

  • Where it wins

    • AST, SSA, and taint analysis cover varied Go security risks
    • GitHub Actions supports pull-request scans and CI workflows
    • Reports export to JSON, SARIF, HTML, YAML, and more

  • Where it doesn't

    • Analysis is focused on Go source code
    • The documented platforms are Linux and macOS
    • AI-assisted fixes require a configurable AI provider

Our verdict on gosec

Gosec is an open-source command-line security scanner for Go projects. It is designed for Go teams that want free source-code analysis in local workflows, pull requests, or continuous integration. Its checks use AST and SSA representations, while taint analysis covers injection, path traversal, SSRF, XSS, and related risks. The scanner also identifies issues such as hardcoded credentials, crypto and TLS weaknesses, unsafe deserialization, and open redirects.

Its strongest fit is a repository workflow built around GitHub Actions. Gosec can run as a GitHub Action, support pull-request workflows, and integrate with CI pipelines. Additional documented integration points include Bazel nogo and Docker. Teams can control rule inclusion and exclusion, apply path-based exclusions, and use configuration files. The published output formats include JSON, SARIF, HTML, YAML, CSV, JUnit XML, SonarQube, golint, and text, giving teams options for review, reporting, and downstream tooling.

Gosec is particularly suitable for teams that standardize on Go and want an open-source SAST option with configurable rules and multiple analysis methods. Its verified language coverage is limited to one language, so teams assessing projects beyond Go should choose a tool with broader language support. The documented workflow centers on command-line and automation use across Linux and macOS. AI-assisted fix suggestions are available through configurable AI providers, but teams should treat that capability as an optional part of the workflow rather than the core scanner. Choose Gosec for focused Go security analysis; consider an alternative when broader language coverage is essential.

Your product? Our editors can test gosec in depth and publish a review, labelled as paid · from $149/mo →

gosec pricing

Plans Free planFree Free to use — no paid tier required for the core job.
See plans on github.com

gosec fact sheet

Free planYes
Paid fromFree
Analysis targetssource code
Languages supportedNot verified
Pull request scansYes
IDE supportNot verified
CI/CD integrationYes
Custom security rulesNot verified
Automated fixesYes
DeploymentSelf-hosted
PlatformsLinux, macOS
SupportDocs
Built forSolo, Small business, Mid-market, Enterprise (editorial estimate)
Integrations3 integrations: GitHub Actions, GitHub code scanning, Bazel nogo
PricingFree plan
Websitegithub.com
Facts checked21 Sep 2026

gosec integrations

gosec lists 3 integrations on its own site.

  • GitHub Actions
  • GitHub code scanning
  • Bazel nogo

Alternatives to gosec

See all gosec alternatives →

Also Ranked In

gosec is ranked in 4 of our directories.

Used gosec? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used gosec for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Your rating

0 characters · at least 80, up to 3,000

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Featured on iTechGuides — gosec 6.9/10

gosec is listed in our SAST Tools directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/gosec/"><img src="https://www.itechguides.com/best/badge/gosec.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update