As Go engineers ourselves, we’ve found that many security scanners simply report that a particular line of code has a security problem without showing the path to exploitation that an attacker would take. So, we built GoKart. Our aim is to provide a user friendly, more accurate and less noisy experience, helping developers discover and understand full attack paths for high impact issues quickly and confidently.

GoKart puts Go code into single static assignment (SSA) form, structuring every value computed by the program as an assignment to a unique variable. One of the major benefits the SSA format brings is the ability to perform taint tracking, the process of determining input sources that could be controlled by an outside source, and controlled by an outside source by tracing how input data is handled.

Read more about how GoKart works in our blog post.