ALalecthomas·May 7, 2024
For those unaware, gosec (and by extension golangci-lint) will warn about uses of `math/rand`
https://github.com/securego/gosec/blob/d3b2359ae29fe344f4df5...
In Secure Randomness in Go 1.22securego
gosec
Go2016–2024
securego / gosec
gosec
Go security checker
10Distinct people
10Mentions
0Explicit recommenders
9KGitHub stars
What to know before exploring
What it is
Go security checker
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year10 dated mentions
Observed mentions: 2016-07-26 16:53:19 UTC to 2024-05-07 10:30:06 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 3 | 1 | 2 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
10 sourcesWhat's the difference between this a https://github.com/securego/gosec?
In Vulnerability Management for GoI defer to using AWS SSM to retrieve secrets https://github.com/kaihendry/dotfiles/blob/master/bin/ssm
But yeah, reading secrets of env or ps or the clipboard is a real issue, so I focus on making sure that doesn't leak.
I've made terrible mistakes leading /proc accidentally in my Web app https://github.com/securego/gosec/issues/569
In How to handle secrets on the command linegosec[1] will warn you about this, at least.
[reuse.go:26] - G601 (CWE-118): Implicit memory aliasing in for loop. (Confidence: MEDIUM, Severity: MEDIUM)
25: wg.Done()
> 26: }(&item)
27: }
[1] https://github.com/securego/gosec
In Down the Golang Nil Rabbit HoleThanks! I've switched jobs six months ago. Previously, I worked moslty solo and relied on staticcheck and other static analysis tools a lot. On this new job I quickly found out we weren't using any tools, and staticcheck was the one I missed the most. Fortunately I was able to show its value, and we are steadily improving our codebase thanks to it.
This and also gosec are invaluable!
Something I looked recently and should adopt soon:
https://github.com/golangci/golangci-lint
So far, this is what my 'de facto' lint list looks like:
echo "Checking for unchecked errors."
errcheck $(go list ./...)
echo "Linting code."
test -z "$(golint `go list ./...` | tee /dev/stderr)"
echo "Examining source code against code defect."
go vet $(go list ./...)
go vet -vettool=$(which shadow)
echo "Running staticcheck toolset https://staticcheck.io"
staticchec
Read the rest
k ./...
echo "Checking if code contains security issues."
# TODO(henvic) fix/update gosec when available:
# G104: Doesn't understand _ assignments #270
# https://github.com/securego/gosec/issues/270
# Ignoring G104: Audit errors not checked for now.
gosec -quiet -exclude G104 --quiet ./...
That’s why tools like gosec complain when user input is used to access files - specifically because ‚..‘ allows one to „escape“.
Gosec: https://github.com/securego/gosec
In Dot Dot Considered HarmfulGosec: Golang Security Checker
1 points · Open discussionDo a lot of reading and reviews. And then more reading. Start here: https://www.owasp.org/
Specifically the TOP 10 webapp issues may be helpful: https://www.owasp.org/index.php/OWASP_Top_Ten_Cheat_Sheet
Read your framework's security guide and adjust the settings properly. (for example https://symfony.com/doc/current/security.html - every framework should have one)
Scan your dependencies for known security issues (gemnasium, sensiolab/security-checker, etc).
Scan your code with tools reporting security issues (like https://github.com/openstack/bandit for python, or https://github.com/HewlettPackard/gas for go).
Based on OWASP make sure bad things are banned in your code - no unparametrised queries, no manual crypto, no cookies without httponly, only modern, salted hashing for passwords, etc. Reuse as much as possible from the framework, b
Read the rest
ecause it's less likely to be vulnerable than new code.
Scan the website tools that can automate finding some common issues for you (ZAP, ratproxy, etc.)
Read the secure development guide https://github.com/OWASP/DevGuide
Hire me to do an audit? (contact in profile)