GitHub Secret Scanning vs gosec

GitHub Secret Scanning detects exposed credentials so they can be secured before exploitation. It scans every branch in Git history, plus issue and pull request content, discussions, wikis, and secret gists. Detected leaks produce repository alerts with details about the credential, while push protection can block secrets before they enter code. Organizations can define regular expressions for their own secret formats. Generic patterns cover items such as private keys, connection strings, and API keys, and AI detection can identify unstructured secrets such as passwords. Validity checks may contact issuing services to see whether credentials remain active. GitHub can work with providers to validate findings and notify them for actions such as revocation. Scanning is automatic and free for public repositories. Private and internal organization repositories require Secret Protection on GitHub Team or Enterprise Cloud; Enterprise Server supports user-owned repositories with that protection. It is available through API, web, and self-hosted deployment, with hybrid deployment.

gosec is a free Go source-code security checker that analyzes abstract syntax trees and static single assignment representations. It applies pattern rules, SSA analyzers, and taint analysis to detect issues including injection, path traversal, SSRF, unsafe deserialization, cryptography and TLS problems, blocklisted imports, and Go-specific risks. Findings map to Common Weakness Enumeration entries. Users can select or exclude rules, define path-based exclusions, and change settings such as audit mode. Reports are available as text, JSON, YAML, CSV, JUnit XML, HTML, SonarQube, golint, and SARIF. The project documents GitHub Actions and SARIF uploads to GitHub code scanning; its goanalysis package supports tools such as Bazel nogo. Local installation requires Go 1.25 or newer, with dependencies loaded through Go modules. An optional AI feature suggests fixes through Atlas Cloud, Gemini, Claude, OpenAI, or custom OpenAI-compatible APIs. Automated detection can produce false positives, which annotations can suppress. It is licensed under Apache License 2.0.