Gosec Integration with DefectDojo
Gosec is an open-source static application security testing (SAST) tool that inspects Go source code for security vulnerabilities by analyzing the Go Abstract Syntax Tree (AST) to identify common programming mistakes including SQL injection, hardcoded credentials, weak cryptographic practices, memory safety issues, and other CWE-mapped security flaws. The tool integrates seamlessly into development workflows through CI/CD pipelines, GitHub Actions, and pre-commit hooks with configurable rules, exclusion capabilities, and multiple output formats including SARIF to enable automated security scanning and remediation guidance throughout the Go application development lifecycle.
Data Granularity: What Gets Imported
The following fields are captured from Gosec results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Gosec",
"engagement": "<engagement-id>",
"file": "results.json"
}