- Home
- Software Composition Analysis Software
- govulncheck
On the recordRead 5 Oct 202614 facts
govulncheck
Plans and prices
Govulncheck
Free
Go source code or binaries · Go vulnerability database
Read 5 Oct 2026 · pkg.go.dev
On the record
- Analysis limits
- Reflection calls are not visible to source analysis, and use of `unsafe` may cause false negatives.pkg.go.dev · read 5 Oct 2026
- Binary limits
- Binaries built with Go versions before 1.18 are checked only for standard library vulnerabilities.pkg.go.dev · read 5 Oct 2026
- Binary scanning
- It can scan compiled Go binaries using their symbol information, but binary results omit call stacks.pkg.go.dev · read 5 Oct 2026
- Custom database
- The `-db` flag can point govulncheck to a different database using HTTP, HTTPS, or file URLs, provided it implements the documented API.go.dev · read 5 Oct 2026
- Editor integration
- The Go language server gopls integrates govulncheck analysis, and the Go docs describe use with VS Code and Vim or NeoVim via coc.nvim.go.dev · read 5 Oct 2026
- Editor limits
- The documented editor scanning features currently do not report vulnerabilities in standard libraries or toolchains.go.dev · read 5 Oct 2026
- Install
- The Go docs show installing it with `go install golang.org/x/vuln/cmd/govulncheck@latest`.go.dev · read 5 Oct 2026
- Output formats
- Govulncheck supports streaming JSON, SARIF, and OpenVEX output.pkg.go.dev · read 5 Oct 2026
- Privacy
- The package documentation says database requests contain only module paths for vulnerabilities already known to the database, not code or other properties of the program.pkg.go.dev · read 5 Oct 2026
- Project status
- The Go vulnerability management project is described as a work in progress and under active development.go.dev · read 5 Oct 2026
- Purpose
- Govulncheck reports known vulnerabilities that affect Go code.pkg.go.dev · read 5 Oct 2026
- Reachability analysis
- It uses source code analysis or a binary’s symbol table to focus reports on vulnerabilities that could affect the application.pkg.go.dev · read 5 Oct 2026
- Support
- The Go docs direct govulncheck issues and feedback to the Go issue tracker.go.dev · read 5 Oct 2026
- Vulnerability data
- By default it uses the Go vulnerability database, whose reports use the OSV schema and are reviewed and curated by the Go Security team.go.dev · read 5 Oct 2026
