govulncheck

5.6easy start · #55 of 65
in Software Composition Analysis Software

Free to practise onnot on record
Free trialnot on record
Well documentednot on record
Runs where you worknot on record

Runs on Linux.

govulncheck is ranked #55 of 65 in software composition analysis software on The Geeks Club. It runs on Linux. There is a free plan.

govulncheck plans and pricing

All plans

Govulncheck Free Go source code or binaries · Go vulnerability database pkg.go.dev · 5 Oct 2026

Compared on software composition analysis software

Supported ecosystems: Go
SBOM generation: Yes
Reachability analysis: Yes
Deployment options: self_hosted

Best govulncheck alternatives

See all 20

Sonatype Nexus Repository 0 of 4 in the starter kit Lesson 18.0 Xygeni 0 of 4 in the starter kit Lesson 27.9 FOSSA 0 of 4 in the starter kit Lesson 37.7 Snyk Open Source 0 of 4 in the starter kit Lesson 47.4 Docker Desktop 0 of 4 in the starter kit Lesson 57.3 Socket 0 of 4 in the starter kit Lesson 67.3

The record

Purpose: Govulncheck reports known vulnerabilities that affect Go code.
Install: The Go docs show installing it with `go install golang.org/x/vuln/cmd/govulncheck@latest`.
Binary scanning: It can scan compiled Go binaries using their symbol information, but binary results omit call stacks.
Editor integration: The Go language server gopls integrates govulncheck analysis, and the Go docs describe use with VS Code and Vim or NeoVim via coc.nvim.
Output formats: Govulncheck supports streaming JSON, SARIF, and OpenVEX output.
Vulnerability data: By default it uses the Go vulnerability database, whose reports use the OSV schema and are reviewed and curated by the Go Security team.
Privacy: The package documentation says database requests contain only module paths for vulnerabilities already known to the database, not code or other properties of the program.
Custom database: The `-db` flag can point govulncheck to a different database using HTTP, HTTPS, or file URLs, provided it implements the documented API.
Analysis limits: Reflection calls are not visible to source analysis, and use of `unsafe` may cause false negatives.
Binary limits: Binaries built with Go versions before 1.18 are checked only for standard library vulnerabilities.
Editor limits: The documented editor scanning features currently do not report vulnerabilities in standard libraries or toolchains.
Project status: The Go vulnerability management project is described as a work in progress and under active development.
Support: The Go docs direct govulncheck issues and feedback to the Go issue tracker.
Price from: Free

Where it ranks on The Geeks Club

Best Software Composition Analysis Software in 2026#55 of 65

Is govulncheck yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote govulncheck

Sources

pkg.go.dev/golang.org/x/vuln/cmd/govulncheck· checked 5 Oct 2026
go.dev/doc/security/vuln/· checked 5 Oct 2026
go.dev/doc/security/vuln/editor· checked 5 Oct 2026
go.dev/doc/security/vuln/database· checked 5 Oct 2026