cid b60b40ed788df9c382c6753c1842eb3fae3c94bb2fba7fdaa5c27853be1196ed · original · open access · via openalex
Title: Evaluating Cryptographic API Misuse Detectors for Go Authors: Vivi Andersson; Martin Monperrus Venue: Year: 2026 Canonical: doi:10.1145/3786165.3788440 URL: https://doi.org/10.1145/3786165.3788440 Collector: openalex OA: true ABSTRACT Cryptographic API misuse represents a critical vulnerability class that undermines the security foundations of modern software. Yet, it remains largely unexplored in Go despite its dominance in security-critical infrastructure. This paper presents the first comprehensive study of cryptographic API misuse detection in Go, identifying and analyzing 4 state-of-the-art tools (CodeQL, Gopher, Gosec, and Snyk Code) and establishing a consolidated taxonomy of 14 relevant misuse classes. Through an experimental evaluation of 328 security-critical open-source Go projects, we discovered 7,473 cryptographic API misuses, providing insights into the prevalence and distribution of these vulnerabilities. Our systematic comparison reveals significant variations in misuse coverage, with immediate practical implications for security engineers and long-term implications for research in this domain.