Re:Golang Security Checker
by Animats on Thursday August 05, 2021 @02:43AM
(#28070607)
It's a linter, not a security model verifier, a fuzzer, or a taint checker. It just looks for a short list of known dumb things to do. Useful, but won't catch anything non-obvious.
[ Parent
| on HN ]
Most security errors are the kind that that the tools catches, like unsanitized SQL or unescaped HTML. Those targeted by nation states or running high value targets probably need third party sec audits, but this is a perfectly good addition to a CI or pre commit hook.
> Most security errors are the kind that that the tools catches
There's plenty of common logic errors that static analysis can't catch.
They may not be readily exploitable by automated scanners, but it doesn't take a nation state.