# gosec

> Security scanner and static analyzer for Go source code

gosec is a static analysis tool that inspects Go code for security vulnerabilities and risky coding patterns. It scans the Go AST and SSA representations using pattern-matching rules and taint analysis to detect issues such as injection risks, weak cryptography, and unsafe file handling. Developers run it locally via the CLI or embed it into CI/CD pipelines and GitHub code scanning with SARIF or JSON outputs.

- Source: https://github.com/securego/gosec
- Homepage: https://securego.io
- License: Apache-2.0
- Built with: Go 98.1%, Other 1.9%
- Stars: 8993
- Forks: 727
- Contributors: 194
- Last commit: 2026-10-29
- Latest release: v2.30.0 (2026-10-23)
- Purpose: Developer tools, Security & identity
- Type: Docker / self-host, CLI, Library / SDK
- For: Personal, Enterprise

## Worth score: 78/100

How much DigGitHub recommends it, from activity, adoption, docs, license and security signals.

- Popularity: 20/25
- Momentum: 10/20
- Maintenance: 25/25
- Community: 11/15
- Readiness: 12/15

## Downloads

Latest release: [v2.30.0](https://github.com/securego/gosec/releases/tag/v2.30.0). Files from the project's GitHub release, not checked by DigGitHub.

Windows:

- [gosec_2.30.0_windows_arm64.tar.gz](https://github.com/securego/gosec/releases/download/v2.30.0/gosec_2.30.0_windows_arm64.tar.gz) (32 MB, 36 downloads)
- [gosec_2.30.0_windows_amd64.tar.gz](https://github.com/securego/gosec/releases/download/v2.30.0/gosec_2.30.0_windows_amd64.tar.gz) (34 MB, 147 downloads)
- [gosec_2.30.0_windows_amd64.tar.gz.sigstore.json](https://github.com/securego/gosec/releases/download/v2.30.0/gosec_2.30.0_windows_amd64.tar.gz.sigstore.json) (3.8 KB, 9 downloads)
- [gosec_2.30.0_windows_arm64.tar.gz.sigstore.json](https://github.com/securego/gosec/releases/download/v2.30.0/gosec_2.30.0_windows_arm64.tar.gz.sigstore.json) (3.7 KB, 7 downloads)

macOS:

- [gosec_2.30.0_darwin_arm64.tar.gz](https://github.com/securego/gosec/releases/download/v2.30.0/gosec_2.30.0_darwin_arm64.tar.gz) (35 MB, 524 downloads)
- [gosec_2.30.0_darwin_amd64.tar.gz](https://github.com/securego/gosec/releases/download/v2.30.0/gosec_2.30.0_darwin_amd64.tar.gz) (36 MB, 86 downloads)
- [gosec_2.30.0_darwin_arm64.tar.gz.sigstore.json](https://github.com/securego/gosec/releases/download/v2.30.0/gosec_2.30.0_darwin_arm64.tar.gz.sigstore.json) (3.9 KB, 8 downloads)
- [gosec_2.30.0_darwin_amd64.tar.gz.sigstore.json](https://github.com/securego/gosec/releases/download/v2.30.0/gosec_2.30.0_darwin_amd64.tar.gz.sigstore.json) (3.7 KB, 8 downloads)

Linux:

- [gosec_2.30.0_linux_s390x.tar.gz](https://github.com/securego/gosec/releases/download/v2.30.0/gosec_2.30.0_linux_s390x.tar.gz) (33 MB, 17 downloads)
- [gosec_2.30.0_linux_ppc64le.tar.gz](https://github.com/securego/gosec/releases/download/v2.30.0/gosec_2.30.0_linux_ppc64le.tar.gz) (32 MB, 18 downloads)
- [gosec_2.30.0_linux_arm64.tar.gz](https://github.com/securego/gosec/releases/download/v2.30.0/gosec_2.30.0_linux_arm64.tar.gz) (32 MB, 964 downloads)
- [gosec_2.30.0_linux_amd64.tar.gz](https://github.com/securego/gosec/releases/download/v2.30.0/gosec_2.30.0_linux_amd64.tar.gz) (34 MB, 9.1k downloads)
- [gosec_2.30.0_linux_s390x.tar.gz.sigstore.json](https://github.com/securego/gosec/releases/download/v2.30.0/gosec_2.30.0_linux_s390x.tar.gz.sigstore.json) (3.8 KB, 6 downloads)
- [gosec_2.30.0_linux_ppc64le.tar.gz.sigstore.json](https://github.com/securego/gosec/releases/download/v2.30.0/gosec_2.30.0_linux_ppc64le.tar.gz.sigstore.json) (3.7 KB, 6 downloads)
- [gosec_2.30.0_linux_arm64.tar.gz.sigstore.json](https://github.com/securego/gosec/releases/download/v2.30.0/gosec_2.30.0_linux_arm64.tar.gz.sigstore.json) (3.8 KB, 7 downloads)
- [gosec_2.30.0_linux_amd64.tar.gz.sigstore.json](https://github.com/securego/gosec/releases/download/v2.30.0/gosec_2.30.0_linux_amd64.tar.gz.sigstore.json) (3.7 KB, 16 downloads)

Other files:

- [bom.json](https://github.com/securego/gosec/releases/download/v2.30.0/bom.json) (60 KB, 12 downloads)

To check the files: [gosec_2.30.0_checksums.txt](https://github.com/securego/gosec/releases/download/v2.30.0/gosec_2.30.0_checksums.txt), [gosec_2.30.0_checksums.txt.sigstore.json](https://github.com/securego/gosec/releases/download/v2.30.0/gosec_2.30.0_checksums.txt.sigstore.json)

## Alternatives

- [infisical](https://diggithub.com/Infisical/infisical.md): Open-source secrets, certificate, and privileged access platform
- [Shannon](https://diggithub.com/KeygraphHQ/shannon.md): AI pentester for your web apps and APIs
- [Ruff](https://diggithub.com/astral-sh/ruff.md): Extremely fast Python linter and formatter
- [AFLplusplus](https://diggithub.com/AFLplusplus/AFLplusplus.md): State-of-the-art coverage-guided fuzzer based on AFL
- [Trivy](https://diggithub.com/aquasecurity/trivy.md): Find vulnerabilities, misconfigurations and secrets
- [RustScan](https://diggithub.com/bee-san/RustScan.md): Modern, fast port scanner
- [mitmproxy](https://diggithub.com/mitmproxy/mitmproxy.md): Interactive TLS-capable intercepting proxy
- [Strix](https://diggithub.com/usestrix/strix.md): AI agents that pentest your own apps

## In collections

- [Protect your server and your code](https://diggithub.com/collections/protect-your-server)

---

Source page: https://diggithub.com/securego/gosec
Updated: 2026-10-31