Gosec Integration with DefectDojo

Gosec Integration with DefectDojo

Gosec is an open source static analysis tool for Go, maintained by the securego project on GitHub. It inspects Go source code by walking its abstract syntax tree and checks it against a set of rules (G101, G104, G401, and so on) covering issues such as hardcoded credentials, unhandled errors, weak cryptography, unsafe file permissions, and injection-prone calls. Each issue carries a severity, a confidence level, and usually a CWE. Gosec can write results as text, JSON, YAML, CSV, JUnit XML, HTML, SARIF, and other formats, and DefectDojo imports the JSON output.

Gosec Integration with DefectDojo

Most of our backend services are written in Go, so Gosec runs in every one of those pipelines. The scan itself takes seconds. The hard part was knowing which of its findings had been looked at, which were real, and which had been fixed. Importing Gosec JSON into DefectDojo gives each issue a Finding on the service's Asset with the rule ID, CWE, file, and line, and every later import updates it. False positives get marked once and stay marked, and real issues get an owner and an SLA.

Why Gosec Matters

Go's standard library makes some mistakes easy to write and hard to spot in review. Gosec is aimed squarely at them.

• It understands Go syntax and types, so its rules target real API usage, such as crypto/md5 imports, math/rand for security values, or unchecked errors.
• Gosec rules are mapped to CWEs, which helps connect Go-specific issues to broader reporting.
• Confidence levels separate near-certain issues from pattern matches that need a human look.
• It runs from the command line against ./..., which fits any CI system.
• Gosec has no memory between runs. It can't tell you which issues were triaged as acceptable or how long a High has been open.

Advantages of This Integration

What we gained by sending Gosec results through DefectDojo:

• Triage that sticks. Marking a finding as a false positive or risk-accepted in DefectDojo carries forward on reimport, so the same issue isn't reviewed again every build.
• Deduplication. DefectDojo compares title, CWE, line, file path, and description, and the title includes the Gosec rule ID, so repeat detections match the existing Finding.
• Lifecycle on reimport. Reimporting each build's report into the same Test mitigates fixed issues, adds new ones, and reactivates regressions.
• CWE-based reporting. Gosec's CWE IDs land in DefectDojo's CWE field, so Go findings roll into the same CWE reports as other languages.
• SLAs and ownership. Gosec severities map directly to High, Medium, and Low, so findings fall under your SLA rules and can be assigned or pushed to Jira.

How This Integration Works

DefectDojo imports Gosec results with the Gosec Scanner scan type.

1. Run Gosec with JSON output. From the module root:

gosec -fmt=json -out=gosec-report.json ./...

Add -no-fail if you want the pipeline step to succeed and let DefectDojo decide what blocks a release.

2. Import the report. In the UI, open the Engagement, choose Import Scan Results, select Gosec Scanner, and upload the JSON. To automate (Community Edition and DefectDojo Pro):

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Gosec Scanner" \
  -F "file=@gosec-report.json" \
  -F "product_name=ledger-service" \
  -F "engagement_name=CI" \
  -F "auto_create_context=true"

DefectDojo Pro users can use Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Gosec Scanner" \
  --report-path "./gosec-report.json" \
  --product-name "ledger-service" \
  --engagement-name "CI" \
  --auto-create-context

3. Reimport on every build. Send later reports to /api/v2/reimport-scan/ against the same Test, so DefectDojo keeps one history per service.

The parser reads the Issues array of the Gosec JSON. Summary statistics and error sections in the report are ignored.

Data Granularity: What Gets Imported

Within one report, issues with the same title, file, and line are imported once.

Use Cases

In a Go service pipeline: Every merge runs Gosec and reimports into the service's Test. Developers see only what changed since the last build, and the release gate checks DefectDojo for new High findings with high confidence.

For a fleet of Go services: A platform team with 50 Go repositories imports each into its own Asset. A CWE report across Assets shows, for example, how many services still use weak hashing, which turns a code pattern into a tracked remediation campaign.

When onboarding an older codebase: The first Gosec run on a legacy service produces hundreds of unchecked error findings. The team risk-accepts the low-severity backlog with an expiry date and focuses SLAs on High findings, without losing track of the rest.

Alongside dependency scanning: Gosec covers first-party code, while a tool like govulncheck covers vulnerable modules. Both import into the same Asset, so Go service risk appears in one place.

Operational Tips

• Run Gosec from the same working directory on every build. Its JSON can contain absolute paths, and the file path is part of the deduplication hash, so a different checkout path on a new runner can make every finding look new.
• Use minimum_severity=Medium if G104 (unhandled errors) floods the Test. You can import the Low results into a separate Test later.
• Sort or filter on Scanner Confidence during triage. HIGH confidence maps to 1, the most certain value in DefectDojo.
• Prefer suppressing accepted patterns with Gosec's #nosec annotation plus a justification in code when the decision belongs with the code, and use DefectDojo risk acceptance when it belongs with the security team.
• Because the description includes the code snippet, a whitespace or formatting change on a flagged line can create a new Finding on reimport. Expect some churn after large reformatting commits.
• Tag imports with the module or branch (for example tags=main) to keep release and feature branch results apart.