gosec vs Semgrep Code
gosec
github.com
Semgrep Code
semgrep.devSide by side
| Figure | gosec | Semgrep Code |
|---|---|---|
| Price from | Free | $15/mo |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | Yes |
| Web | — | Yes |
| Windows | — | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 7 |
| Spec score · Static Application Security Testing Sast | 8.6 (#3) | 8.7 (#2) |
| Spec score · SAST Tools | 8.6 (#4) | 8.7 (#3) |
| Spec score · Static Application Security Testing Software | 8.6 (#4) | 8.7 (#2) |
| Detection | It includes pattern-based rules, SSA analyzers, and taint analysis for risks such as injection, path traversal, SSRF, and unsafe deserialization. | Its multimodal detection combines deterministic SAST for issues such as XSS and SQL injection with AI analysis for complex flaws such as IDOR and business logic vulnerabilities. |
| Documentation depth | Secure Go publishes per-rule guidance pages and links to API reference, Stack Overflow and Slack support channels. | Documentation covers scanning, rule writing, CLI commands, APIs, integrations, billing, support and release notes, with community Slack and GitHub issue support. |
| Open-source licence | The repository is licensed under the Apache License 2.0. | The Semgrep OSS engine is open source under the GNU LGPL 2.1; Semgrep-maintained rules use a separate Semgrep Rules License restricting redistribution and competing or SaaS use. |
| Purpose | gosec inspects Go source code for security problems by scanning its AST and SSA code representation. | Semgrep Code is a static application security testing product that finds code vulnerabilities and helps developers fix them. |
| What it does | gosec scans Go source code by analyzing Go abstract syntax trees and static single-assignment representations for security problems. | Semgrep Code combines deterministic static analysis with AI analysis to identify traditional vulnerabilities such as XSS and SQL injection plus complex issues such as IDOR and business-logic flaws. |
Plans
Semgrep Code
- Free EditionFree
- Free EditionFree
- Teams Secrets$15 a month
- Teams — Code$30 a month
- Teams Code$30 a month
- Teams Supply Chain$30 a month
- EnterprisePriced on request
In their own words
gosec
gosec is a free Go source-code security checker that analyzes abstract syntax trees and static single assignment representations. It applies pattern rules, SSA analyzers, and taint analysis to detect issues including injection, path traversal, SSRF, unsafe deserialization, cryptography and TLS problems, blocklisted imports, and Go-specific risks. Findings map to Common Weakness Enumeration entries. Users can select or exclude rules, define path-based exclusions, and change settings such as audit mode. Reports are available as text, JSON, YAML, CSV, JUnit XML, HTML, SonarQube, golint, and SARIF. The project documents GitHub Actions and SARIF uploads to GitHub code scanning; its goanalysis package supports tools such as Bazel nogo. Local installation requires Go 1.25 or newer, with dependencies loaded through Go modules. An optional AI feature suggests fixes through Atlas Cloud, Gemini, Claude, OpenAI, or custom OpenAI-compatible APIs. Automated detection can produce false positives, which annotations can suppress. It is licensed under Apache License 2.0.
Semgrep Code
Semgrep Code is a cloud-based static application security testing product for finding vulnerabilities in source code and helping developers address them. It combines deterministic analysis for issues such as XSS and SQL injection with AI analysis aimed at complex flaws, including IDOR and business logic vulnerabilities. Pull requests can carry tailored, step-by-step remediation instructions, and the product supports 35 programming languages. Semgrep lists integrations with GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure and Buildkite, plus VS Code and IntelliJ extensions and Slack, email and webhook notifications. The Free Edition includes Code and Supply Chain, with scanning for up to 10 repositories and a limit of 10 contributors. Teams supports up to 500 private repositories; Enterprise has no repository or contributor limit. For local or fully CI-based scans, code stays on the user's computer or CI environment; opting into AI processing sends part of a file containing a finding to a model. The Free Edition costs nothing. Teams — Code is listed at $30 a month.