Go Flow Safe
summary
Shows a practical taint-analysis workflow using Go Flow Leeve: identify sensitive fields (passwords, auth structs), write a YAML config mapping sources, sanitizers and sinks (regex supported), and run it over a whole project to get concrete source and sink line numbers. Detects SQL injection and logging of secrets across files, lets users mark false positives with a “do not report” comment, but currently models fields not methods and still over-approximates some flows.
AI-written summary · about
chapters (4)
related talks
14mCloudFlow: Identifying Security-sensitive Data Flows in Serverless
45mEssential security checks for your Go project
34mAttack Flow - Beyond Atomic Behaviors
24mGoing Secure with Go
23mFlowCog: Context-aware Semantics Extraction and Analysis of Information Flow Leaks in Android Apps
34mKeep your code safe during the development path using OS tools
23mStopping vulnerabilities at the source
25mExploring Some Essential Security Checks for Any Open Source Go Project