Skip to main content

Precaution versus Gosec​

When choosing a Static Application Security Testing (SAST) tool for Python projects, it’s important to consider how different tools align with your development workflow and security needs. This comparison focuses on Precaution and Gosec, two popular options with distinct approaches and feature sets.

Programming Languages​

LanguagePrecautionGosec
Go✅✅
Java✅❌
Python✅❌

Rule Coverage​

Precaution RuleGosec Rules
GO001: crypto - weak cipherG405: weakcrypto
GO002: crypto - weak hashG401: weakcryptohash
GO003: crypto - weak keyG403: rsa
GO004: syscall - unnecessary privileges
GO005: crypto - unrestricted bindG102: bind
GO006: net - unrestricted bindG102: bind
GO007: net/http - no timeoutG114: http_serve
GO501: x/crypto - insecure ignore hostkeyG106: ssh
GO502: x/crypto - weak cipher
GO503: x/crypto - weak hashG406: weakdepricatedcryptohash
GO504: unix - unnecessary privileges

Footnotes​

  1. Precaution only checks on whether a function call introduces a vulnerability not simply a import of a module. ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7

Last updated on