Security checker for Go source code
Inspects Go source code through its AST and SSA representation to find security problems such as injection, weak crypto and unsafe file handling.
gosec scans Go packages for security issues using a set of rules, each with an identifier (for example G101 for hard-coded credentials). It understands Go modules and can run on a whole project with a single command.
It is integrated into golangci-lint and available as a GitHub Action, so it often runs as part of existing Go linting.
Apache-2.0 · Apache License 2.0 · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: Apache-2.0.
No published advisory found for gosec in GitHub repository advisories and OSV.dev. That does not mean the tool has no vulnerabilities.
Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.
Lightweight, pattern-based static analysis
Fast static analysis engine where rules look like the code they match, supporting many languages; the open-source Community Edition runs locally and in CI.
Security linter for Python code
Static analyser from the PyCQA that builds an AST of each Python file and runs plugins to flag common security issues.
Static analyser for Solidity and Vyper
Trail of Bits' static analysis framework for Solidity and Vyper with dozens of vulnerability detectors, printers and an API for custom analyses.
Rust-based Solidity static analyser
Cyfrin's static analyser for Solidity written in Rust, with detectors, Markdown audit-style reports and editor integration.
