diff --git a/format/format.go b/format/format.go
index 3fc3bdd..71bf391 100644
--- a/format/format.go
+++ b/format/format.go
@@ -313,17 +313,28 @@ func (f *fumpter) lineEnd(line int) token.Pos {
 //
 //	//go:          | standard Go directives, like go:noinline
 //	//some-words:  | similar to the syntax above, like lint:ignore or go-sumtype:decl
-//	//line         | inserted line information for cmd/compile
 //	//export       | to mark cgo funcs for exporting
 //	//extern       | C function declarations for gccgo
-//	//sys(nb)?     | syscall function wrapper prototypes
-//	//nolint       | nolint directive for golangci
+//	//line         | inserted line information for cmd/compile
 //	//noinspection | noinspection directive for GoLand and friends
+//	//nolint       | nolint directive for golangci
+//	//#nosec       | #nosec directive for gosec
 //	//NOSONAR      | NOSONAR directive for SonarQube
+//	//sys(nb)?     | syscall function wrapper prototypes
 //
 // Note that the "some-words:" matching expects a letter afterward, such as
 // "go:generate", to prevent matching false positives like "https://site".
-var rxCommentDirective = regexp.MustCompile(`^([a-z-]+:[a-z]+|line\b|export\b|extern\b|sys(nb)?\b|no(lint|inspection)\b)|NOSONAR\b`)
+var rxCommentDirective = regexp.MustCompile(
+	`^(?:` +
+		`[a-z-]+:[a-z]+` +
+		`|export` +
+		`|extern` +
+		`|line` +
+		`|no(?:inspection|lint)` +
+		`|#nosec` +
+		`|NOSONAR` +
+		`|sys(?:nb)?` +
+		`)\b`)
 
 func (f *fumpter) applyPre(c *astutil.Cursor) {
 	f.splitLongLine(c)
diff --git a/testdata/script/comment-spaced.txtar b/testdata/script/comment-spaced.txtar
index aac33b1..a79eb8e 100644
--- a/testdata/script/comment-spaced.txtar
+++ b/testdata/script/comment-spaced.txtar
@@ -32,6 +32,10 @@ package p
 
 //noinspection foo,bar
 
+//#nosec
+
+//#nosec G000 G999 -- explanation
+
 //not actually: a directive
 
 //https://just.one/url
@@ -99,6 +103,10 @@ package p
 
 //noinspection foo,bar
 
+//#nosec
+
+//#nosec G000 G999 -- explanation
+
 // not actually: a directive
 
 // https://just.one/url