gosec
Go security analysis with type information and taint tracking.
Why install it
Section titled “Why install it”gosec understands Go’s types, so it follows untrusted input into SQL queries, shell commands, file paths and outgoing requests, and flags weak cryptography and unsafe defaults that pattern matching alone misses. For an organization that writes Go it is the deepest SAST pass Argus can run.
At a glance
Section titled “At a glance”| Finds | SAST |
| Reads | Go |
| Trust level | Drives a toolchain |
| Official image | Not included |
| Licence | Apache-2.0 |
| Argus tool | run_gosec |
Install
Section titled “Install”The official Argus container image does not ship gosec: add it by building your own image on top of the official one, or install every one of these binaries on the daemon host:
go:brew install go (or see https://go.dev/doc/install)gosec:go install github.com/securego/gosec/v2/cmd/gosec@latest (or brew install gosec)
For other platforms, follow the official install guide. Argus looks for scanners once, when the daemon starts: restart it after installing, and argus doctor shows gosec as installed.