The Complete Production SOP: How to Deploy and Run GoSec Golang Security AST Analyzer in Autonomous AI Agents

---
name: "gosec-golang-security-scanner"
description: "Audit Go source code for security flaws, unsafe pointers, and weak cryptography."
metadata:
  author: "SecureGo"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "run gosec security scan"
  - "fix golang sql injection gosec"
  - "audit go tls config"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: true
  net_access: false
---

# GoSec Golang Security AST Analyzer SOP
1. Run gosec -quiet -fmt=json -out=gosec-report.json ./...
2. Parse Issues array: map each RuleID (e.g., G201, G402) to file and line.
3. Apply targeted deterministic remediations:
   - G201/G202: Replace string concatenation with db.QueryContext(ctx, query, args...).
   - G402: Force MinVersion: tls.VersionTLS13 in tls.Config.
   - G304: Enforce filepath.Clean and strings.HasPrefix(target, baseDir).
4. Re-run gosec -quiet -fmt=json to verify zero High or Medium severity findings.

# Ignore test vectors and vendor directories
vendor/*
**/*_test.go
mocks/*

Please run gosec security scan on our ./internal/repository and ./internal/transport packages. If any G201 (SQL injection) or G402 (TLS config) issues are reported, remediate them using parameterization and TLS 1.3 standards, then verify zero findings remain.

package transport

import (
	"crypto/tls"
	"net/http"
)

// NewSecureServer constructs an http.Server enforcing TLS 1.3 (G402 compliance)
func NewSecureServer(addr string, handler http.Handler) *http.Server {
	return &http.Server{
		Addr:    addr,
		Handler: handler,
		TLSConfig: &tls.Config{
			MinVersion:               tls.VersionTLS13,
			PreferServerCipherSuites: false, // TLS 1.3 ciphersuites are fixed
		},
	}
}