Description

Detects when gRPC clients are configured with insecure connection options in Go code. Using insecure gRPC connections can expose communication channels to man-in-the-middle attacks and data interception since traffic is not encrypted.

Detection Strategy

• Identifies import statements for the google.golang.org/grpc package

• Locates gRPC connection method calls like grpc.Dial() or grpc.DialContext()

• Examines connection options passed to these methods

• Reports a vulnerability when insecure transport options like grpc.WithInsecure() are used in the connection configuration

Vulnerable code example

package main

import (
    "google.golang.org/grpc"
    "google.golang.org/grpc/credentials/insecure"
)

func main() {...

✅ Secure code example

package main

import (
    "crypto/tls"
    "google.golang.org/grpc"
    "google.golang.org/grpc/credentials"
    "log"
)...