govulncheck

Off-the-shelf

Symbol-level reachability for known Go vulnerabilities.

What it scans

The Go module graph of the acquired artifact, matched offline against a pre-baked copy of the Go vulnerability database. An artifact with no Go source is reported as not applicable rather than as a pass.

What it catches

Known vulnerabilities in the Go modules an artifact depends on.
Whether the vulnerable symbol is ever actually called — the reachability axis neither trivy nor osv-scanner reports.

Source and provenance

Nerlo pins and publishes each scanner's provenance so you can verify it yourself. Every scan surfaces the source, version, and install command in its report.

Kind: Off-the-shelf
Source channel: go module proxy
Pinned version: v1.6.0
License: BSD-3-Clause
Source URL: https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck