security-review

To scan a Terraform provider codebase for Go security vulnerabilities, run the security-review workflow to execute gosec static analysis. It detects common vulnerabilities directly within Go sources and produces a structured report detailing findings and severities.

The best way to detect secrets and misconfigurations in Terraform provider code is using trivy filesystem, secret, and config scanning. This process identifies exposed risks early and outputs remediation steps to secure the codebase.

Yes, osv-scanner works alongside trunk for dependency vulnerability scanning. While trunk integrates Semgrep and Gitleaks checks, osv-scanner specifically scans open source dependencies to identify known vulnerabilities across the Terraform provider codebase.

The security review handles false positives from gosec and trivy by applying explicit guardrails during analysis. It produces a structured report that separates verified threats from false positives and includes planning for remediation steps.

You should exclude checkov during Terraform provider security audits when using the integrated trunk workflow, which explicitly omits checkov to streamline Semgrep and Gitleaks checks. This prevents overlapping infrastructure as code scans during development and CI.

Yes, you can run gosec and trivy checks during pre-release CI pipelines. The security review workflow applies static analysis, dependency, and secret scanning across development, CI, and pre-release stages to identify risks early.