[go-fan] Go Module Review: securego/gosec

[github-actions]

🐹 Go Fan Report: securego/gosec/v2

Module Overview

github.com/securego/gosec/v2 is Go's most widely-used static security scanner. It walks the AST/SSA and flags classic security issues — hardcoded credentials (G101), SQL injection (G201–G203), unsanitized file paths (G304/G305), subprocess-from-variable (G204), integer-overflow conversions (G115), weak randomness (G404), decompression bombs (G110), and more. It's a build-time CI tool in gh-aw, not a linked dependency.

Why it came up today: gosec is the most recently active direct dependency — the repo was pushed to 2026-07-20, and v2.28.0 (2026-07-14, the version gh-aw pins) is the latest release. We're fully up to date. ✅

Current Usage in gh-aw

• Files: 1 source reference (tools.go blank import pins the version) + Makefile (security-gosec) + .github/workflows/security-scan.yml (daily 06:00 UTC SARIF scan) + .golangci.yml.
• Inline suppressions: 39 #nosec directives in non-test source.
• Invocation flags: -exclude-generated -track-suppressions -nosec-require-rules -nosec-require-justification -exclude=G602.

Research Findings

gosec is on the latest release and gh-aw already adopts its stricter posture — -nosec-require-rules and -nosec-require-justification — which is the current best practice for auditable suppressions.

Recent Updates (v2.27 to v2.28)

• feat(G101): detect AWS temporary access keys.
• fix(G404): flag additional missing math/rand weak-random functions.
• fix: fewer G115 false positives for min/max patterns.
• Toolchain bumped to Go 1.26.5 / 1.25.12.

Best Practice (from the gosec README)

The #nosec comment should have the format #nosec [RuleList] [-- Justification]. The justification should be after the rule(s) to suppress and start with two or more dashes.

-nosec-require-justification rejects directives that do not carry a -- justification, and a rejected directive no longer suppresses its finding.

Improvement Opportunities

🏃 Quick Wins — 10 malformed #nosec justifications (likely surfacing as code-scanning alerts)

Because CI runs -nosec-require-justification, a suppression is only honored when the justification starts with -- (two+ dashes). Ten directives use a single ASCII dash - or a Unicode em-dash —, so gosec treats them as unjustified and re-reports the underlying finding as a SARIF alert:

File:Line	Rule	Current separator
pkg/console/render.go:594	G115	-
pkg/console/render.go:599	G115	-
pkg/console/render.go:602	G115	-
pkg/console/render.go:614	G115	-
pkg/console/render.go:653	G115	-
pkg/console/render.go:656	G115	-
pkg/console/render.go:667	G115	-
pkg/cli/logs_download.go:413	G305	-
pkg/cli/logs_download.go:439	G110	-
pkg/cli/experiments_command.go:339	G304	— (em-dash)

Fix: change each - / — to -- (the justification text is already fine). Mechanical and zero-risk. The other 29 non-test suppressions already use -- correctly.

✨ Feature Opportunities

• G115 min/max FP fix (v2.28.0): the 7 render.go G115 suppressions are legit display narrowings, but worth re-checking after the fix — some may no longer trigger and could drop the #nosec entirely.
• G404 tightening (v2.28.0) flags more weak-random calls; re-validate the add_command.go / update_git.go G404 exclusions against the standalone scan.

📐 Best Practice Alignment

• Dead gosec config in .golangci.yml: gosec is disabled in golangci-lint, and make security-gosec runs gosec directly (it does not read .golangci.yml). So the ~25 gosec exclude-rules there apply nowhere today — the real suppression surface is -exclude=G602 + inline #nosec. The file's comment ("Exclusions for gosec are applied when running gosec directly via make security-gosec") is misleading: that command applies only -exclude=G602. Recommend marking them reference-only or moving still-needed rules into inline #nosec / a gosec config so intent lives in one place.
• Duplicate exclusion: .golangci.yml lists G204 for pkg/cli/mcp_inspect_mcp.go twice. Harmless but redundant.

🔧 General Improvements

• Add a small CI guard (regex) that rejects any #nosec Gxxx not followed by --, so the separator mistake can't recur silently.
• gosec's version is pinned in three places (tools.go + Makefile + security-scan.yml); consider driving the CI invocation off the go.mod/tools.go version to keep a single source of truth.

Recommendations (prioritized)

1. Fix the 10 malformed #nosec separators (-/— to --) — likely clears 10 code-scanning alerts. High value, trivial.
2. Add a CI regex guard so the separator format can't regress.
3. Clarify/prune the dead gosec block in .golangci.yml and drop the duplicate G204 rule.
4. Re-check the 7 render.go G115 suppressions against v2.28.0's min/max FP fix.

Next Steps

• PR normalizing the 10 #nosec separators to --.
• Consider the CI separator guard.
• Tidy .golangci.yml gosec section (dead rules + duplicate).

---

Generated by Go Fan
Module summary saved to: scratchpad/mods/securego-gosec.md

Generated by 🐹 Go Fan · 169.7 AIC · ⌖ 13.5 AIC · ⊞ 7.3K · ◷

• expires on Jul 21, 2026, 1:02 AM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · 2.74 AIC · ⌖ 6.12 AIC · ⊞ 7.5K · ◷