CheckOps home

Tools directory

G

CheckOps

govulncheck

govulncheck is the Go team's BSD-licensed vulnerability scanner that reports known vulnerabilities from the Go vulnerability database only when your code actually calls the affected functions.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

govulncheck is part of Go’s vulnerability management tooling, backed by the Go vulnerability database curated by the Go security team. It reduces noise by surfacing only vulnerabilities in functions your code actually calls. The tooling lives in the golang/vuln repository (a mirror of the Go project’s source).

The source code is at golang/vuln on GitHub under the BSD-3-Clause licence, with about 536 stars; the most recent commit was on 11 October 2026.

Features

  1. Reachability analysis: Reports only called vulnerable functions.
  2. Source and binary modes: Scan code or compiled binaries.
  3. Curated database: Go vulnerability database.
  4. JSON and SARIF output: For CI and dashboards; see docs.
  5. Official Go tool: Maintained by the Go team.

Pros

  1. Free to use: Open source under BSD-3-Clause.
  2. Maintained: Commits as recent as 11 October 2026.

Cons

  1. Go only: Single ecosystem.
  2. Known vulnerabilities only: No code-level SAST.
go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...

Resources:

Pricing

govulncheck is free and open source under the BSD-3-Clause licence.

  1. Go teams wanting low-noise dependency scanning.
  2. CI pipelines for Go services.
  3. Not a fit for other languages.

Conclusion

govulncheck gives Go projects low-noise vulnerability results thanks to reachability analysis.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with govulncheck side by side.