Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

govulncheck

Free#51 of 65 in Software Composition Analysis Software

govulncheck: Free Go vulnerability checks prioritize findings by whether vulnerable functions are called. Ranked #51 of 65 in Software Composition Analysis Software by our editors (5.3/10); pricing: Open source; best for go teams needing reachability-focused vulnerability checks.

5.3/10Editor score
Visit govulncheck
govulncheck5.3 Visit govulncheck

At a glance

  • Editor score
    5.3 / 10
  • Pricing
    Open source
  • Best for
    Go teams needing reachability-focused vulnerability checks
  • Paid from
    Free
  • SBOM generation
    Yes
  • Facts checked
    19 Sep 2026
govulncheck screenshot

  • Where it wins

    • Analyzes Go source code and compiled binaries for known vulnerabilities
    • Prioritizes findings using vulnerable function calls and provides call-stack summaries
    • Emits JSON, SARIF, and VEX outputs for tooling and workflow integration

  • Where it doesn't

    • Focused on the Go ecosystem rather than multiple languages
    • A command-line, self-hosted tool rather than a hosted subscription service
    • Its scope is known-vulnerability analysis, not a general-purpose security platform

Our verdict on govulncheck

For Go developers who want to identify known vulnerabilities in source code or compiled binaries, govulncheck is an open-source command-line scanner from the Go team. It draws vulnerability information from the Go Vulnerability Database and prioritizes issues based on whether the application calls vulnerable functions. That reachability focus can help teams distinguish potentially relevant findings from vulnerabilities in code paths their application does not call. It is a focused fit for Go projects, rather than a cross-language software composition analysis platform.

The tool's strongest distinction is how it presents findings: it can provide call-stack summaries for affected code and emit JSON, SARIF, and VEX output. These formats support use alongside other developer and security tooling. Its integrations include gopls, the VS Code Go extension, and GitHub Actions, so teams can bring checks into editor and CI workflows. The Go Vulnerability Database is also an integration and the source of vulnerability information. This ecosystem alignment makes govulncheck relevant to teams already working within Go's tooling environment; it does not make the tool a broad platform for managing dependencies across different ecosystems.

Because govulncheck is distributed as open-source Go tooling, there is no hosted subscription tier to weigh against paid plans. Teams should expect to work with a command-line, self-hosted tool, and its defined scope is checking Go source or binaries for known vulnerabilities. Choose it when Go coverage, reachability-based prioritization, and structured outputs are the priorities. Teams seeking one scanner for projects in multiple language ecosystems or a broader security platform should consider alternatives designed for that wider scope.

Your product? Our editors can test govulncheck in depth and publish a review, labelled as paid · from $149/mo →

govulncheck pricing

Plans Open sourceFree Free to use — no paid tier required for the core job.
See plans on go.dev

govulncheck fact sheet

Free planNot verified
Paid fromFree
Supported ecosystemsGo
SBOM generationYes
Reachability analysisYes
Pull request scanningNot verified
Monitored projectsNot verified
Deployment optionsSelf_hosted
Integrations4 integrations: Go Vulnerability Database, gopls, VS Code Go extension, GitHub Actions
PricingOpen source
Websitego.dev
Facts checked19 Sep 2026

govulncheck integrations

govulncheck lists 4 integrations on its own site.

  • Go Vulnerability Database
  • gopls
  • VS Code Go extension
  • GitHub Actions

Alternatives to govulncheck

See all govulncheck alternatives →

Used govulncheck? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used govulncheck for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Your rating

0 characters · at least 80, up to 3,000

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Featured on iTechGuides — govulncheck 5.3/10

govulncheck is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/govulncheck/"><img src="https://www.itechguides.com/best/badge/govulncheck.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update