wdevs/ResolveSpec
5
0
Fork 0
mirror of https://github.com/bitechdev/ResolveSpec.git synced 2026-10-01 19:20:31 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

chore(gosec): enable gosec and address findings

Browse Source
This commit is contained in:
Hein
2026-09-30 13:16:12 +02:00
parent 9533c3a0ed
commit f66930c3c9
37 changed files with 133 additions and 122 deletions
Download Patch File Download Diff File Expand all files Collapse all files
audit/pkg/_CROSS-CUTTING.audit.md
+9 -1
View File
@@ -232,7 +232,15 @@ disables the signal entirely.
---
### X4. Medium — `gosec` is not enabled
### X4. Medium — `gosec` is not enabled — **RESOLVED**
> **Status (2026-09-30):** `gosec` is now in `linters.enable` and the repository lints clean
> (0 issues). The initial run produced 115 findings. Real fixes: login-form values in
> `security/oauth_server.go` are now HTML-escaped (G705), and `SqlSparseVector` index
> parsing uses `ParseInt(..., 10, 32)` (G109). The remaining ~110 sites carry
> `//nolint:gosec // Gxxx: <reason>` comments. The G201/G701 reasons (identifiers from
> trusted config or internal/validated names) and the G115 range claims were not
> individually audited and still need review. The text below describes the state before the change.
`.golangci.json` (`version: 2`) enables exactly three linters beyond the v2
standard set: