govulncheck

What it does

Analysis limits

Reflection calls are not visible to source analysis, and use of `unsafe` may cause false negatives.checked 5 Oct 2026

Binary limits

Binaries built with Go versions before 1.18 are checked only for standard library vulnerabilities.checked 5 Oct 2026

Binary scanning

It can scan compiled Go binaries using their symbol information, but binary results omit call stacks.checked 5 Oct 2026

Custom database

The `-db` flag can point govulncheck to a different database using HTTP, HTTPS, or file URLs, provided it implements the documented API.checked 5 Oct 2026

Editor integration

The Go language server gopls integrates govulncheck analysis, and the Go docs describe use with VS Code and Vim or NeoVim via coc.nvim.checked 5 Oct 2026

Editor limits

The documented editor scanning features currently do not report vulnerabilities in standard libraries or toolchains.checked 5 Oct 2026

Install

The Go docs show installing it with `go install golang.org/x/vuln/cmd/govulncheck@latest`.checked 5 Oct 2026

Output formats

Govulncheck supports streaming JSON, SARIF, and OpenVEX output.checked 5 Oct 2026

Privacy

The package documentation says database requests contain only module paths for vulnerabilities already known to the database, not code or other properties of the program.checked 5 Oct 2026

Project status

The Go vulnerability management project is described as a work in progress and under active development.checked 5 Oct 2026

Purpose

Govulncheck reports known vulnerabilities that affect Go code.checked 5 Oct 2026

Reachability analysis

It uses source code analysis or a binary’s symbol table to focus reports on vulnerabilities that could affect the application.checked 5 Oct 2026

Support

The Go docs direct govulncheck issues and feedback to the Go issue tracker.checked 5 Oct 2026

Vulnerability data

By default it uses the Go vulnerability database, whose reports use the OSV schema and are reviewed and curated by the Go Security team.checked 5 Oct 2026