gosec

• Category: sast (Go)
• Fingerprint: rule-file-surrounding-3-lines-v1
• License: Apache-2.0

The canonical Go SAST. Vetrix's FromGosecJSON adapter normalises its JSON output; fingerprints survive reformatting of surrounding lines (the +/- 3 line normalisation in internal/sarif/fingerprint.go).

sast:
  gosec: { enabled: true }

When to enable

Always on Go projects.

Common false positives

• G304 (file inclusion via variable) fires inside test helpers that intentionally build paths from test data. Dismiss with a scoped reason or wrap with // #nosec G304 in the source.
• G404 (insecure RNG) fires on any use of math/rand — if you are not generating security-sensitive values, the warning is cosmetic.