Essential security checks for your Go project
summary
Shows concrete tooling and outcomes: gosec (36 built‑in rules) runs as a fast single binary with SARIF output and GitHub Action integration and detects an SSRF example; SSA‑based analysis improves cross‑function taint tracking versus AST rules; use Go’s native fuzzing corpus to find crashes and input‑validation bugs; run govulncheck/go tool against modules to trace vulnerable call paths (example flagged a Go 1.21.4 vulnerability) and publish signatures with sigstore/cosign signing for release authenticity.
AI-written summary · about
chapters (15)
- 0:00Introduction and speaker background
- 1:30Talk overview and goals
- 2:12Code security fundamentals
- 4:43Input validation and injections
- 6:33Automated security checks necessity
- 8:01GoSec static analyzer overview
- 10:54GoSec in action demo
- 13:50Static code analysis with AST
- 16:41Static code analysis with SSA
- 18:55Integrating GoSec in workflows
- 22:31Fuzzing for vulnerabilities
- 26:09Dependency security and supply chain
- 28:20GoCheck for dependency scanning
- 31:12Securing releases and binaries
- 34:05Q&A session
related talks
25mExploring Some Essential Security Checks for Any Open Source Go Project
05mLightning Talk: Improving The Security Of Your Go Applications
31mGo Security – Past, Present, and Future
24mGoing Secure with Go
57mGo Security
21mVulnerability Management for Go
26mSecurity Automation For GraphQL
20mBuilding Secure Software OpenSSF Best Practices for Everyone!