Exploring Some Essential Security Checks for Any Open Source Go Project
summary
Shows concrete CI steps and tools to harden Go projects: add gosec as a fast GitHub Action emitting SARIF, run fuzzing with Go’s built‑in fuzzer and OSS‑Fuzz to catch edge cases, scan dependencies with govulncheck (it found three vuln paths in a recent run) and keep Go versions updated, and sign releases and container images with sigstore/cosign via go‑releaser. Describes 50+ gosec rules, SSA/taint limits, an LLM autofix prototype for rule output, and where automation still misses coverage.
AI-written summary · about
chapters (9)
- 0:00Introduction to security checks
- 1:03Code security overview
- 6:10Static code analysis in Go
- 9:21Live demo with GOC
- 13:53Fuzzing in Go projects
- 16:35Dependency security practices
- 19:53Supply chain security basics
- 23:00Signing artifacts demo
- 23:32Q&A and closing
related talks
45mEssential security checks for your Go project
05mLightning Talk: Improving The Security Of Your Go Applications
24mGoing Secure with Go
31mGo Security – Past, Present, and Future
32mSecure and reliable development with Go
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
37mBringing Security to Your Open Source Project
57mGo Security