Overlap
Security for Go
Security tools that run on Go. The Catch for each, not a winner list.
8 tools · the Catch, not a ranking
- TrivyApache-2.0 all-in-one vuln/IaC/secret/SBOM scanner; no paid tier
CLI/CI scanner — not Aqua Platform management UI/RBAC/policy SaaS. Vs Grype/Snyk: Aqua OSS default with broad target surface; Aqua Inc monetizes a separate commercial platform. You still triage and patch.
- CosignApache-2.0 Sigstore keyless container/artifact signing CLI
Signing CLI + public-good Sigstore infra — not a full policy admission controller (pair with Kyverno/OPA). Offline/air-gap needs different PKI. Registry must support referrers/OCI artifacts cleanly.
- GitleaksMIT secret scanner for git/dirs/stdin; CLI free, org Action needs free key
Maintainer marks feature-complete (security patches; focus shifting to Betterleaks). Official Action for GitHub org repos needs a free license key from gitleaks.io — personal accounts exempt. Not a full ASVS/SAST suite. False positives need allowlists.
- GrypeApache-2.0 SBOM-first vulnerability scanner from Anchore; free CLI
Vuln scanner — not Trivy's IaC/secrets swiss-army, not Cosign signing, not Anchore Enterprise governance UI. You still triage CVEs. Anchore monetizes Enterprise separately.
- AnubisMIT PoW challenge layer vs AI scrapers in front of Caddy/Traefik
PoW slows mass scrapers; determined headless solvers still pass. Can impede Archive/RSS unless you allowlist. Not Cloudflare WAF. Distinct from Traefik/Caddy proxies.
- OSV-ScannerApache-2.0 OSV.dev vulnerability scanner for lockfiles and images
Vs Trivy/Grype (broader/image-first scanners) and Syft (*SBOM producer*): OSV-Scanner is the OSV.dev-native vuln CLI, not a replacement for every Trivy filesystem/misconfig check and not the SBOM generator. Complements those tools; do not expect identical CVE sets. Networked API unless you go `--offline`.
- gVisorApache-2.0 userspace container sandbox — OCI runtime runsc for agent isolation
Linux only (kernel 5.6+ recommended). Not every syscall is implemented — exotic workloads fail or fall back. Heavy file and network I/O pay a measurable overhead versus runc. This is a runtime, not an SDK or an orchestration product: you still wire Docker/K8s/agent harnesses yourself. Vs Firecracker/Cloud Hypervisor (microVMs) and plain seccomp: gVisor is the userspace kernel middle path.
- KyvernoApache-2.0 CNCF Kubernetes policy engine — policies as YAML, not Rego
Enforces at admission time, so a bad policy (or an unavailable webhook with fail-closed settings) can block deploys cluster-wide — roll out in audit mode first. YAML policies get awkward for complex logic; Rego-based engines express that more cleanly. Vs kubescape (posture and compliance scanning) and topaz (application authorization): Kyverno is the in-cluster admission policy lane.