security-scanlisted

**Version**: 1.0 **Created**: 2026-03-21 **Last Updated**: 2026-03-21 **Authors:** Ömer Ufuk --- # /security-scan — Static Application Security Testing ## When to Use Invoke `/security-scan` when: - Before merging any feature that handles user input, file I/O, or external communication - As a pre-release security gate alongside `/dep-audit` and `/secret-scan` - After refactoring security-sensitive code paths (auth, crypto, subprocess execution) - When onboarding a new codebase to establish a security baseline - Periodically as part of security hygiene (weekly or per-sprint) --- ## Prerequisites Install the scanning tools: ```bash # gosec (Go security checker) go install github.com/securego/gosec/v2/cmd/gosec@latest # semgrep (multi-language SAST) pip install semgrep # or: brew install semgrep # Verify installations gosec --version 2>/dev/null || echo "gosec not installed" semgrep --version 2>/dev/null || echo "semgrep not installed" ``` --- ## Invocation ```bash /security-scan ``` --- ## Behavior ### Step 1: gosec Scan Run Go-specific security analysis: ```bash gosec -fmt json ./... ``` gosec checks for Go-specific patterns including: - Hardcoded credentials (G101) - SQL injection via string formatting (G201, G202) - Unescaped HTML in templates (G203) - Command injection via exec (G204) - Weak cryptographic primitives (G401, G501) - Insecure TLS configuration (G402) - File path traversal (G304) - Unsafe file permissions (G302) - Decompression bombs (G110)