To run SAST on a Go project, use a static security checker over the whole module, choose an output format your pipeline understands, and treat the exit code as the gate. The open source gosec checker is a common example: it inspects the Go syntax tree and SSA representation for security problems.
Run it
From the module root:
gosec ./...
Per the gosec README, the exit code is 0 when there are no unsuppressed findings or errors and 1 otherwise, which suits a CI gate. A flag exists to force exit code 0 for report only runs.
Pick an output format
gosec supports text, JSON, YAML, CSV, JUnit XML, HTML, SonarQube, golint and SARIF. For code scanning dashboards:
gosec -fmt sarif -out results.sarif ./...
See what SARIF is and when you need it.
Read the rule IDs
| Range | Area |
|---|---|
| G1xx | General: hardcoded credentials, unsafe use, HTTP hardening, cookies |
| G2xx | Injection in queries, templates and commands |
| G3xx | File handling: permissions, traversal, temp files, archive extraction |
| G4xx | Crypto and TLS weaknesses |
| G5xx | Blocklisted imports |
| G6xx | Go specific correctness |
| G7xx | Taint analysis: SQL and command injection, SSRF, XSS and others |
Control the noise
You can include or exclude rules, suppress a single finding inline with a justification, exclude paths, and skip generated files. Test files are skipped unless you ask for them. Use suppression with a reason, never blanket exclusion, and review suppressions in code review.
What it will not find
Authorization mistakes, business logic flaws and vulnerabilities in dependencies. For modules you import, you need dependency scanning. Go supply chain incidents have involved malicious packages, which static analysis of your own code cannot see.
Steps
- Run once and record the baseline.
- Fix G2xx and G3xx findings first, since they are the most exploitable.
- Add the SARIF upload to CI.
- Fail on new findings only.
- Add dependency scanning and an SBOM.
How Safeguard helps
Safeguard offers dependency scanning and SBOMs, reachability analysis, and autonomous remediation with fix pull requests, which is off by default with every category on Manual. The free scan is the easiest first step.
Try it yourself
Click through it at your own pace, or open it full screen.
Compare the severity and location of each finding with how you would triage it.
Quick check
Does a Go SAST scan check my imported modules?
No. It analyzes your code. Use dependency scanning for modules.
How do I make the scan fail the build?
Rely on the non zero exit code when unsuppressed findings exist.
Sources
- gosec README on GitHub (fetched 19 October 2026): exit codes, formats, rule groups, suppression.
Last reviewed: 19 October 2026.
