Security Scanner Exclusions
Test Type
Tool
Status
Vulnerability scanning
govulncheck
✅ Pass
Shell execution audit
Custom test
✅ Pass
Credential scanning
Custom test
✅ Pass
Go security patterns
gosec
⚠ 13 findings (reviewed)
Pattern-based analysis
semgrep
⚠ 1 finding (reviewed)
Rule
Description
Reason
G104
Audit errors not checked
Excessive noise; golangci-lint handles critical errors
G201
SQL string formatting
Placeholder generation, not user input concatenation
G204
Subprocess execution
CLI uses validated git parameters; no shell interpolation
G304
File path from variable
CLI designed to read user-specified files; inputs validated
G306
Poor file permissions
Default permissions appropriate for cache/config files
Gosec Findings (All Safe)
Category
Count
Reason Safe
File operations (G304)
~8
CLI tool designed to read user files; validated inputs
Subprocess execution (G204)
~3
Git operations use validated commit hashes; no shell
SQL formatting (G201)
1
Dynamic placeholder generation; proper parameterization
Unhandled errors (G110)
~1
Non-critical buffer operations
Finding
Location
Reason Safe
String-formatted SQL query
pkg/database/database.go:303Generates placeholders ?,?,? only; values passed separately to db.Exec()
Reporting Security Issues Contact maintainer privately - do not open public issues.