* feat: add debug build profiling support
Add CPU and memory profiling capabilities for debug builds using Go build
tags. Profiling code is completely excluded from release builds.
Changes:
- Add profiling_debug.go with -cpuprofile and -memprofile flags (build tag: debug)
- Add build-debug and build-debug-race Makefile targets
- Refactor main() to run() pattern for proper defer handling
- Replace logger.Fatal() with logger.Printf() + return for clean exits
- Pass logger to profiling for consistent [gosec] log prefix
Usage:
make build-debug
./gosec-debug -cpuprofile cpu.prof -memprofile mem.prof ./...
* Refactor profiling: encapsulate state and improve error handling
- Encapsulate profiling state in Profiler struct to eliminate package-level mutable state
- Add proper error handling with error returns instead of silent failures
- Add exit code constants (exitSuccess/exitFailure) to replace magic numbers
- Fix Makefile clean target to remove gosec-debug binary
- Add nil logger guard for safety
* Use exit constants in all return statements
Replace remaining magic numbers (0, 1) with exitSuccess and exitFailure
constants throughout the run() function for consistency.
---------
Co-authored-by: Oittaa <eero@oittaa.net>
* add path-based rule exclusions
Implements #1287
* Ssupport for excluding specific rules from specific paths, enabling large monorepos to apply different security rules to different components (e.g., CLI tools vs services).
* fix formatting issuue with path filter test to pass gci
* Refactor rules to utilize callListRule base structure
- Introduced a new base structure `callListRule` in `rules/base.go` to standardize the implementation of rules that check for specific function calls.
- Updated existing rules to inherit from `callListRule`, simplifying their structure and removing redundant ID methods.
- Modified the `MetaData` field to use `RuleID` instead of `ID` for consistency across rules.
- Removed the `weakcryptohash.go` and `weakdepricatedcryptohash.go` files as their functionality has been integrated into the new structure.
* fix(tlsconfig): correct MetaData field name in generated TLS check
* refactor: standardize rule metadata and call list initialization
* feat(ai): add OpenAI and custom API provider support
- Expand AI provider support to include OpenAI (gpt-4o, gpt-4o-mini) and custom OpenAI-compatible APIs
- Add support for configuring AI API base URL and skipping SSL verification
- Update documentation to list all supported AI providers and clarify configuration options with examples
- Refactor AI client initialization to fallback on OpenAI-compatible API for unknown models
- Add OpenAI client implementation using openai-go library
- Update tests to validate OpenAI-compatible fallback behavior
- Add openai-go dependency to go.mod
Signed-off-by: appleboy <appleboy.tw@gmail.com>
* Fix info message after merge
Change-Id: I1cb556a42e2bd9e9b2051d6db99889c6c9f7ccdb
Signed-off-by: Cosmin Cojocar <ccojocar@google.com>
* Fix lint warning
Change-Id: I3689b96205f494920dbbd03344e8f132a30f40b3
Signed-off-by: Cosmin Cojocar <ccojocar@google.com>
---------
Signed-off-by: appleboy <appleboy.tw@gmail.com>
Signed-off-by: Cosmin Cojocar <ccojocar@google.com>
Co-authored-by: Cosmin Cojocar <cosmin@cojocar.ch>
Co-authored-by: Cosmin Cojocar <ccojocar@google.com>
* This change does not exclude analyzers for inline comment
* Changed the expected issues count for G103, G109 samples for test. Previously G115 has been included in the issue count
* Show analyzers IDs(G115, G602) in gosec usage help
* See #1175
This feature adds support to generate auto fixes for Go scanning findings using LLM (AI). In a first instance, it relies on Gemini API to get a suggestion for a solution. This can be later extended, to integrate also other AI providers.
---------
Signed-off-by: Cosmin Cojocar <ccojocar@google.com>
Co-authored-by: ccoVeille <3875889+ccoVeille@users.noreply.github.com>
Co-authored-by: Cosmin Cojocar <ccojocar@google.com>
Track ignored issues using file location instead of a AST node. There are issues linked to a different AST node than the original node used to start the scan.
Signed-off-by: Cosmin Cojocar <gcojocar@adobe.com>
The new flag '-terse' will only show the results and summary ignoring any logs occured during a scan.
Signed-off-by: Cosmin Cojocar <gcojocar@adobe.com>
* feat: add concurrency option to parallelize package loading
* refactor: move wg.add inside the for loop
* fix: gracefully stop the workers on error
* test: add test for concurrent scan
Cosmin Cojocar
Ravi Sastry Kadali
oittaa
wei dong
Matteo Calabrò
renovate[bot]andCosmin Cojocar
Oleksandr Redko
Laurent Demailly
Rahul Gadi
Alex Gartner
Cosmin Cojocar
Oleksandr Redko
Matthieu MOREL
Dmitry Golushko
Ludovic Fernandez
Tim CostaandTim Costa
Cosmin Cojocar
Per Arn
kruskal
kaiili
Ville Skyttä
Yiwei Ding
Ville Skyttä
Ryan Leung
Matthieu MOREL
Nanik
Marc Brugger