awesome-golang-security

nosurf

CSRF protection middleware for Go

gorilla/csrf

Provides Cross-Site Request Forgery (CSRF) prevention middleware for Go web applications & services

gorilla/securecookie

Encodes and decodes authenticated and optionally encrypted cookie values for Go web applications

secure

Secure is an HTTP middleware for Go that facilitates most of your security needs for web applications

unindexed

A drop-in replacement for which disables directory indexing

beego-security-headers

beego framework filter for easy security headers management

paseto

Platform-Agnostic Security Tokens implementation in GO (Golang)

hsts

Go HTTP Strict Transport Security library

jwt-go

Golang implementation of JSON Web Tokens (JWT)

httprobe

Take a list of domains and probe for working HTTP and HTTPS servers

safesql

Static analysis tool for Golang that protects against SQL injections. It does not seem to be actively maintained at the moment

gosec

Inspects source code for security problems by scanning the Go AST and matching it with a set of rules. Comes bundled in a Docker container

gometalinter

Concurrently runs most of the existing go linters and normalizes their output

A tool that lets you query your code like data, in order to find vulnerabilities and bugs. See also for pull request integration and running queries in the cloud

ChainJacking

Find which of your Go lang direct GitHub dependencies is susceptible to ChainJacking attack

The golang release mailing list. Language-specific security issues are announced here

and - Free vulnerability data around Go Modules

Commercial but free listing of known vulnerabilities in libraries

Vulnerabilities that were assigned a CVE. Covers the language and packages

Golang known vulnerabilities in the National Vulnerability Database

CloudFlare SSL

CFSSL is CloudFlare's PKI/TLS swiss army knife. It is both a command line tool and an HTTP API server for signing, verifying, and bundling TLS certificates

govwa

A vulnerable golang application including the most common vulnerabilities found in web applications today

Lambhack

A very vulnerable serverless application in AWS Lambda

Go Secure Example Application (GOSEA)

by OWASP - [PDF] Talk given by Sulhaedir at the OWASP Jakarta meetup

OWASP Go - Secure Coding Practices

by Checkmarx - Go programming language secure coding practices guide

Handling data securely in memory

[Video] GopherCon 2018, Liz Rice

golang-tls

Simple Golang HTTPS/TLS Examples

Hacking with Go

Hacking with Go for security professionals

by Checkmarx - Diving Deep into Regular Expression Denial of Service (ReDoS) in Go

: A detailed description on Security assessment techniques for Go projects