Security - The Go Programming Language

Common problems companies solve with Go
Stories about how and why companies use Go
How Go can help keep you secure by default
The official Go language specification
A complete introduction to building software with Go
Reference documentation for Go's standard library
Learn what's new in each Go release
Tips for writing clear, performant, and idiomatic Go code
Videos from prior events
Meet other local Go developers
Learn and network with Go developers from around the world
The Go project's official blog.
Get help and stay informed from Go
This page provides resources for Go developers to improve security for their projects.
(See also: Security Best Practices for Go Developers.)
Go’s vulnerability detection aims to provide low-noise, reliable tools for developers to learn about known vulnerabilities that may affect their projects. For an overview, start at this summary and FAQ page about Go’s vulnerability management architecture. For an applied approach, explore the tools below.
Developers can use the govulncheck tool to determine whether any known vulnerabilities affect their code and prioritize next steps based on which vulnerable functions and methods are actually called.
The VS Code Go extension checks third-party dependencies and surfaces relevant vulnerabilities.
Pkg.go.dev is a website for discovering, evaluating and learning more about Go packages and modules. When discovering and evaluating packages on pkg.go.dev, you will see a banner on the top of a page if there are vulnerabilities in that version. Additionally, you can see the vulnerabilities impacting each version of a package on the version history page.
The Go vulnerability database collects data directly from Go package maintainers as well as from outside sources such as MITRE and GitHub. Reports are curated by the Go Security team.
Consult the Security Policy for instructions on how to report a vulnerability in the Go project. The page also details the Go security team’s process of tracking issues and disclosing them to the public. See the release history for details about past security fixes. Per the release policy, we issue security fixes to the two most recent major releases of Go.
Go native fuzzing provides a type of automated testing which continuously manipulates inputs to a program to find bugs. Go supports fuzzing in its standard toolchain beginning in Go 1.18. Native Go fuzz tests are supported by OSS-Fuzz.
Go’s cryptography libraries aim to help developers build secure applications. See documentation for the crypto packages and golang.org/x/crypto/.
Go’s cryptography libraries can be used in a FIPS 140-3 compliant mode for use in regulated environments. See the FIPS 140-3 Compliance documentation for more information.