SaaSHub helps you find the best software and product alternatives Learn more →
Top 23 Go Security Projects
-
Project mention: I got tired of setting up SSL for every side project, so I made a 60-second Docker deploy kit | dev.to | 2026-05-19
The secret is Caddy. Unlike Nginx, Caddy handles SSL automatically — it requests certificates from Let's Encrypt and renews them without any configuration. The entire reverse proxy config is 3 lines:
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
-
trivy
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
Project mention: trivy VS onequery - a user suggested alternative | libhunt.com/r/trivy | 2026-06-01 -
nuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Let's look at an example of such an error in the Nuclei project, a vulnerability scanner that allows creating user-defined templates.
-
-
A layer of deterministic constraints: checks that keep the output converging toward quality instead of tech debt. I work in Python, so for me that's ruff, ty, tach run through prek, plus gitleaks and a stack of project-specific hooks. Different language, different tools — the constraint is the point, not the toolchain.
-
trufflehog is also worth a look — it actually verifies whether detected secrets are still live by calling the relevant APIs. Useful for triage when you find old hits.
-
Project mention: War Story: Debugging a Kafka 4.0 Consumer Lag Spike During a Product Launch Using Cilium 1.17 and Datadog 2026 | dev.to | 2026-04-28
This adds less than 2% overhead to your node’s CPU usage but exposes 14 Kafka-specific eBPF metrics that are critical for debugging lag. We’ve found that 72% of Kafka 4.0 lag incidents we’ve responded to in 2026 stem from node-level network policy issues that only eBPF can detect. If you’re using a different CNI, you can still use Cilium’s standalone eBPF probe https://github.com/cilium/cilium/tree/v1.17.2/contrib/kafka-probe to get these metrics without replacing your entire CNI. Always validate that kafka.heartbeat_drops_total is 0 in staging before every launch.
-
Lean and Mean Docker containers
Slim(toolkit): Don't change anything in your container image and minify it by up to 30x (and for compiled languages even more) making it secure too! (free and open source)
Project mention: I Ditched Docker for Podman (and You Should Too) | news.ycombinator.com | 2025-09-05 -
age
A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.
Project mention: Get your passwords out of Bitwarden while you still can | news.ycombinator.com | 2026-05-21if you have to do the 'encrypt single plaintext file' dance at least use age[0] in 2026
[0] https://age-encryption.org/
-
Project mention: Get your passwords out of Bitwarden while you still can | news.ycombinator.com | 2026-05-21
-
Stars: 14.8k | Language: Python GitHub: https://github.com/goauthentik/authentik
-
SafeLine
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
In today’s post we’ll get going at getting SafeLine excellent WAF (Web Application Firewall) to agree at running on Rootless Docker setup.
-
Gravitational Teleport
The easiest, and most secure way to access and protect all of your infrastructure.
-
twpayne/chezmoi
-
The other approach that largely turned out to be security theater was Anubis, which proudly proclaimed itself the watchdog of the internet, weigher of souls, but in the words of its creator "Over time I thought the proof-of-work was actually doing something for security, but no — any barrier makes the low-effort scrapers confused and give up." Really, the rapid FOSS adoption (200k downloads to date) has largely just rehashed Hashcash and propagated anime cat girls throughout the internet, besides actively calling out Mozilla as the benevolent god of bots (except that it is not only trivial to bypass, it ignores curl). As it turns out, the more valuable your website, the higher the floor of computation you need to use, but at some point you have to pay latency debts back, so you have a ceiling where this works out. People abandoned Hashcash for good reason, it burdens legitimate users while doing nothing to bots who wants to squeeze you for value and provide nothing back.
-
bettercap
The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
-
Ory Hydra
Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.
Project mention: Show HN: Open-source OAuth2 server Ory Hydra 25.4 ships OAuth2.1 and Device Auth | news.ycombinator.com | 2025-11-11 -
bytebase
World's most advanced database DevSecOps solution for Developer, Security, DBA and Platform Engineering teams. The GitHub/GitLab for database DevSecOps.
-
crowdsec
CrowdSec - the open-source and participative security solution offering crowdsourced protection against malicious IPs and access to the most advanced real-world CTI.
Project mention: CrowdSec – protection against malicious IPs and access to real-world CTI | news.ycombinator.com | 2025-09-24 -
Project mention: Run Phishing Simulations for $37/Month Instead of $30,000/Year | dev.to | 2026-01-15
GoPhish is an open-source phishing simulation framework. It's been around for 10+ years, has 10,000+ installations, and is MIT licensed.
-
Project mention: Performance Test: Grype 0.70 vs Trivy 0.50 Scan Times – 15% Faster for Alpine Images | dev.to | 2026-04-28
After 120+ benchmark runs across 6 Alpine image variants, 2 hardware configurations, and 3 CI environments, our verdict is clear: Grype 0.70 is 15% faster than Trivy 0.50 for Alpine-based container images, with identical vulnerability detection parity. For teams scanning Alpine images at scale, this speedup translates to thousands of dollars in CI compute savings and hundreds of engineer hours reclaimed per month. If you're only scanning Alpine images, migrate to Grype today—the 15% speedup is worth the migration effort for any team with more than 100 daily scans. For heterogeneous image stacks, Trivy remains the better all-in-one option. We recommend running the benchmark script we provided earlier on your own images to validate the speedup for your specific workload.
-
vuls
Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices
-
Netmaker
Netmaker makes networks with WireGuard. Netmaker automates fast, secure, and distributed virtual networks.
Project mention: I finally understand Cloudflare Zero Trust tunnels | news.ycombinator.com | 2025-11-16$3 VPS running Headscale is not simpler since you won't be able to run both headscale and tailscale on your end user machines, I don't recommend it.
The solution we've found is running a white IP container (or VPS) which looks like regular Wireguard outside, while inside it "forwards" to your existing tailscale network.
I don't remember if we use https://github.com/gravitl/netmaker or https://github.com/juhovh/tailguard
NOTE:
The open source projects on this list are ordered by number of github stars.
The number of mentions indicates repo mentiontions in the last 12 Months or
since we started tracking (Dec 2020).
Go Security discussion
Go Security related posts
-
cerbos VS onequery - a user suggested alternative
2 projects | 1 Jun 2026 -
trivy VS onequery - a user suggested alternative
2 projects | 1 Jun 2026 -
I scanned 8 popular open-source repos for outdated dependencies and CVEs. Here's what I found.
-
Nobody on the internet knows if you are a human
-
Bumblebee vs OSV-Scanner: Two Takes on Supply Chain Scanning
-
Get your passwords out of Bitwarden while you still can
-
How to Stop Accidentally Committing AWS Keys to GitHub
-
A note from our sponsor - SaaSHub
www.saashub.com | 9 Jun 2026
Index
What are some of the best open-source Security projects in Go? This list will help you:
| # | Project | Stars |
|---|---|---|
| 1 | Caddy | 73,224 |
| 2 | trivy | 35,597 |
| 3 | nuclei | 29,060 |
| 4 | authelia | 27,974 |
| 5 | gitleaks | 27,526 |
| 6 | trufflehog | 26,628 |
| 7 | cilium | 24,441 |
| 8 | Lean and Mean Docker containers | 23,293 |
| 9 | age | 22,502 |
| 10 | sops | 22,016 |
| 11 | authentik | 21,844 |
| 12 | SafeLine | 21,460 |
| 13 | Gravitational Teleport | 20,463 |
| 14 | chezmoi | 20,077 |
| 15 | anubis | 19,761 |
| 16 | bettercap | 19,385 |
| 17 | Ory Hydra | 17,198 |
| 18 | bytebase | 14,116 |
| 19 | crowdsec | 13,719 |
| 20 | gophish | 13,652 |
| 21 | grype | 12,344 |
| 22 | vuls | 12,172 |
| 23 | Netmaker | 11,602 |
Sponsored
SaaSHub - Software Alternatives and Reviews
SaaSHub helps you find the best software and product alternatives
www.saashub.com