Does gosec write HTML?

Yes — `gosec -fmt=html -out=gosec.html ./...` writes a standalone page. It also supports json, yaml, csv, junit-xml, sonarqube, golint, sarif and text.

Should I use HTML or SARIF?

HTML if the page is the destination. SARIF if you are also uploading to code scanning — then render the SARIF and you have both from one run.

How do I handle false positives?

`#nosec` annotations suppress a finding in code, and `-exclude` skips rules globally. Both lose the reasoning; that is what an anchored comment on the published report is for.

Should gosec fail the build?

Run the gate as its own unmuted step with the severity threshold you actually enforce, and keep the reporting step muted so medium findings still publish.

Keep it private or team-scoped. The report quotes the offending source lines, which is more than you want on a public URL.

Share a gosec report

gosec is unusual among security scanners: it will hand you a rendered page without a converter in the middle. -fmt=html writes the findings, the rule ids, the severity and confidence, and the offending source lines, all in one file.

Which leaves exactly one problem — that file is on a CI runner that will be deleted in ten minutes.

One command

go install github.com/securego/gosec/v2/cmd/gosec@latest

gosec -fmt=html -out=gosec.html ./... || true

|| true because gosec exits non-zero when it finds something, and the run with findings is the one worth publishing. Keep a separate unmuted gate step with the severity threshold you enforce.

Publish it

Drag gosec.html into the app, or from CI:

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html gosec.html \
        --arg title "gosec — $GITHUB_REF_NAME" '{title: $title, html: $html}')"

Restrict the access level — the report includes your source lines. Private or team-scoped; see the sharing model.

`#nosec` is where the reasoning goes to die

Every Go codebase running gosec ends up with a scatter of #nosec G304 comments. The annotation suppresses the finding; it almost never records why, and the -- reason convention is honoured about half the time.

A published report gives that reasoning somewhere durable:

Anchored threads on the finding: "G304 — the path comes from a fixed allowlist three frames up, not user input." Next to the code, readable by the next person and by the auditor. See commenting on HTML.
Revisions, so a suppression that was added under deadline pressure is still visible six months later.
A routine re-scanning on a schedule, because new rules ship and old code does not change.

Limits

Entry HTML: 5 MB. Assets: 25 MB per file, 250 MB and 500 files total. A first scan on a large monorepo is the one that gets close — scan per module for the shareable view.
60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Publish a security report →