$ go install github.com/securego/gosec/v2/cmd/gosec@latest

# binary will be $(go env GOPATH)/bin/gosec
curl -sfL https://raw.githubusercontent.com/securego/gosec/master/install.sh | sh -s -- -b $(go env GOPATH)/bin vX.Y.Z

# or install it into ./bin/
curl -sfL https://raw.githubusercontent.com/securego/gosec/master/install.sh | sh -s vX.Y.Z

# In alpine linux (as it does not come with curl by default)
wget -O - -q https://raw.githubusercontent.com/securego/gosec/master/install.sh | sh -s vX.Y.Z

# If you want to use the checksums provided on the "Releases" page
# then you will have to download a tar.gz file for your operating system instead of a binary file
wget https://github.com/securego/gosec/releases/download/vX.Y.Z/gosec_vX.Y.Z_OS.tar.gz

name: Run Gosec
on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master
jobs:
  tests:
    runs-on: ubuntu-latest
    env:
      GO111MODULE: on
    steps:
      - name: Checkout Source
        uses: actions/checkout@v2
      - name: Run Gosec Security Scanner
        uses: securego/gosec@master
        with:
          args: ./...

$ gosec -h

gosec - Golang security checker

gosec analyzes Go source code to look for common programming mistakes that
can lead to security problems.

VERSION: dev
GIT TAG:
BUILD DATE:

USAGE:

	# Check a single package
	$ gosec $GOPATH/src/github.com/example/project

	# Check all packages under the current directory and save results in
	# json format.
	$ gosec -fmt=json -out=results.json ./...

	# Run a specific set of rules (by default all rules will be run):
	$ gosec -include=G101,G203,G401  ./...

	# Run all rules except the provided
	$ gosec -exclude=G101 $GOPATH/src/github.com/example/project/...


OPTIONS:

  -color
    	Prints the text format report with colorization when it goes in the stdout (default true)
  -conf string
    	Path to optional config file
  -confidence string
    	Filter out the issues with a lower confidence than the given value. Valid options are: low, medium, high (default "low")
  -exclude string
    	Comma separated list of rules IDs to exclude. (see rule list)
  -exclude-dir value
    	Exclude folder from scan (can be specified multiple times)
  -fmt string
    	Set output format. Valid options are: json, yaml, csv, junit-xml, html, sonarqube, golint, sarif or text (default "text")
  -include string
    	Comma separated list of rules IDs to include. (see rule list)
  -log string
    	Log messages to file rather than stderr
  -no-fail
    	Do not fail the scanning, even if issues were found
  -nosec
    	Ignores #nosec comments when set
  -nosec-tag string
    	Set an alternative string for #nosec. Some examples: #dontanalyze, #falsepositive
  -out string
    	Set output file for results
  -quiet
    	Only show output when errors are found
  -severity string
    	Filter out the issues with a lower severity than the given value. Valid options are: low, medium, high (default "low")
  -sort
    	Sort issues by severity (default true)
  -stdout
    	Stdout the results as well as write it in the output file
  -tags string
    	Comma separated list of build tags
  -tests
    	Scan tests files
  -verbose string
    	Overrides the output format when stdout the results while saving them in the output file.
    	Valid options are: json, yaml, csv, junit-xml, html, sonarqube, golint, sarif or text
  -version
    	Print version and quit with exit code 0


RULES:

	G101: Look for hardcoded credentials
	G102: Bind to all interfaces
	G103: Audit the use of unsafe block
	G104: Audit errors not checked
	G106: Audit the use of ssh.InsecureIgnoreHostKey function
	G107: Url provided to HTTP request as taint input
	G108: Profiling endpoint is automatically exposed
	G109: Converting strconv.Atoi result to int32/int16
	G110: Detect io.Copy instead of io.CopyN when decompression
	G201: SQL query construction using format string
	G202: SQL query construction using string concatenation
	G203: Use of unescaped data in HTML templates
	G204: Audit use of command execution
	G301: Poor file permissions used when creating a directory
	G302: Poor file permissions used when creation file or using chmod
	G303: Creating tempfile using a predictable path
	G304: File path provided as taint input
	G305: File path traversal when extracting zip archive
	G306: Poor file permissions used when writing to a file
	G307: Unsafe defer call of a method returning an error
	G401: Detect the usage of DES, RC4, MD5 or SHA1
	G402: Look for bad TLS connection settings
	G403: Ensure minimum RSA key length of 2048 bits
	G404: Insecure random number source (rand)
	G501: Import blocklist: crypto/md5
	G502: Import blocklist: crypto/des
	G503: Import blocklist: crypto/rc4
	G504: Import blocklist: net/http/cgi
	G505: Import blocklist: crypto/sha1
	G601: Implicit memory aliasing in RangeStmt

$ gosec ./...
...
Summary:
  Gosec  : dev
  Files  : 186
  Lines  : 27434
  Nosec  : 0
  Issues : 292

[/Users/xuxinhua/project/golang/studygolang/cmd/studygolang/background.go:57] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    56: 		// 生成阅读排行榜
  > 57: 		c.AddFunc("@daily", genViewRank)
    58:

$ gosec -exclude ./...
...
Summary:
  Gosec  : dev
  Files  : 186
  Lines  : 27434
  Nosec  : 0
  Issues : 51

[/Users/xuxinhua/project/golang/studygolang/logic/sitemap.go:266] - G307 (CWE-703): Deferring unsafe method "Close" on type "*os.File" (Confidence: HIGH, Severity: MEDIUM)
    265: 	}
  > 266: 	defer file.Close()
    267:

$ gosec -include=G101 ./...
...
[/Users/xuxinhua/project/golang/studygolang/http/http.go:437] - G101 (CWE-798): Potential hardcoded credentials (Confidence: LOW, Severity: HIGH)
    436: const (
  > 437: 	TokenSalt       = "b3%JFOykZx_golang_polaris"
    438: 	NeedReLoginCode = 600

Summary:
  Gosec  : dev
  Files  : 186
  Lines  : 27434
  Nosec  : 0
  Issues : 1