- Replace gosec with govulncheck (official Go vulnerability scanner)
- Add dedicated security.yml workflow with multiple tools:
- govulncheck: Official Go team vulnerability scanner
- Nancy: Sonatype dependency vulnerability scanner
- Staticcheck: Go static analysis with security checks
- Semgrep: Multi-language security scanner
- CodeQL: GitHub semantic security analysis
- Dependency Review: Automated dependency vulnerability checking
- Update golangci-lint config to temporarily disable gosec
- Add CodeQL configuration for enhanced Go security analysis
- Separate fast CI checks from comprehensive security scanning
- Schedule daily security scans at 2 AM UTC
- Integrate with GitHub Security tab via SARIF reports
