security-audit

Review code against each OWASP category using the provided checklists, comparing patterns like parameterized queries versus string-formatted SQL. Run govulncheck ./... to scan dependencies for known vulnerabilities, then compile findings into a severity-ranked report.

Run govulncheck ./... to detect vulnerabilities in your module dependencies. Use go list -u -m all to check for available updates and keep components current.

The report contains a severity summary counting Critical, High, Medium, and Low findings, a table of vulnerabilities with file and line references, and prioritized remediation steps mapped to CVE or CWE identifiers.

Yes, category A03 covers injection flaws. It flags string-formatted queries built with fmt.Sprintf and recommends parameterized queries with placeholders such as $1 passed separately to db.QueryRow.

A checklist audit relies on manual pattern matching and may miss business-logic flaws or complex multi-step attack chains. It complements but does not replace penetration testing or dedicated dynamic analysis tools.