# govulncheck

Hacker Approved page: https://hackerapproved.com/p/govulncheck/

9 people recommended govulncheck in Hacker News comments, 2 had mixed feelings and none criticized it, November 2025 to October 2026. It was recommended in 9 of 12 months, in 9 threads. It does not meet the Hacker Approved badge rule.

**Verdict:** Go's official tool flags a vulnerability only when your code actually calls the affected function, so it avoids alerts for unused dependencies. Critics say it still produces some false positives.

Summary written by Claude from 17 comments. It was written before the November 2026 recount, and 15 of those comments still count.

## Why people recommend it

- Built into the Go toolchain (5 comments in the sample): "Static and dynamic analysis of binaries for free, built into the language ecosystem itself" ([source](https://news.ycombinator.com/item?id=48928935)) "That is a lot of great tooling working to make things more secure in the Go ecosystem." ([source](https://news.ycombinator.com/item?id=48260767)) "The Go ecosystem has achieved something amazing here with govulncheck" ([source](https://news.ycombinator.com/item?id=46059760))
- Flags only reachable vulnerable code (3 comments in the sample): "it does call flow analysis and won't claim you're vulnerable just because you used a module" ([source](https://news.ycombinator.com/item?id=47224484)) "govulncheck tells me if my codebase is actually affected by CVEs or not" ([source](https://news.ycombinator.com/item?id=50180238)) "tracing actual code paths to verify vulnerable functions are called" ([source](https://news.ycombinator.com/item?id=47095265))
- Combines static and dynamic analysis (1 comment in the sample): "offers a novel dynamic/static analysis hybrid approach to vulnerability management" ([source](https://news.ycombinator.com/item?id=48681549))

## Other vulnerability scanners people recommend

- [OpenAI Codex Security](https://hackerapproved.com/p/codex-security/): 16 recommend, 3 mixed, 28 criticize
- [cargo-vet](https://hackerapproved.com/p/cargo-vet/): 8 recommend, 0 mixed, 0 criticize
- [Aikido Safe-Chain](https://hackerapproved.com/p/aikido-safe-chain/): 7 recommend, 0 mixed, 1 criticize
- [Socket](https://hackerapproved.com/p/socket-dev/): 6 recommend, 1 mixed, 3 criticize

## The badge

A product earns the Hacker Approved badge when at least 10 people recommend it, recommenders outnumber critics at least 2 to 1 (mixed feelings count toward neither side), it was recommended in at least 4 of the 12 months and in at least 5 different threads, and no single thread supplies more than half of the people who recommend it. Health and money products are never badged.

## Cite as

Hacker Approved, "govulncheck", https://hackerapproved.com/p/govulncheck/ (9 recommend, 2 mixed, 0 criticize; Hacker News comments, November 2025 to October 2026).

Counts updated 2 Nov 2026, with data through October 31, 2026.