govulncheck
Hacker ApprovedRanked 2 of 10 vulnerability scanners by recommenders
Go's official tool flags a vulnerability only when your code actually calls the affected function, so it avoids alerts for unused dependencies. Critics say it still produces some false positives.
Go's official tool flags a vulnerability only when your code actually calls the affected function, so it avoids alerts for unused dependencies. Critics say it still produces some false positives.
13 people gave an opinion
- recommend it
- 13
- criticize it
- 0
- approval share
- 100%
Recommended in 9 of 13 months
- November 2025: recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 13 people recommend itNeeds 10 or more, met.
- Nobody criticizes itNeeds 2 to 1 or better, met.
- Recommended in 9 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Flags only reachable vulnerable code
“it actually traces call paths so you only get alerted if the vulnerable function is reachable from your code”
Comment from 20 Feb 2026 in “Turn Dependabot Off” “go lang has a scanner which only shows issues when the code actually calls the effected functions”
Comment from 3 Aug 2026 in “Critical CVE issued for hallucinated SQLite vulnerability” “it does call flow analysis and won't claim you're vulnerable just because you used a module”
Comment from 2 Mar 2026 in “Go is the best language for agents” - Comment from 21 Oct 2026 in “Security advisory: Critical remote code execution vulnerabilities, update now”
- Comment from 20 Feb 2026 in “Turn Dependabot Off”
Built into the Go toolchain
“Static and dynamic analysis of binaries for free, built into the language ecosystem itself”
Comment from 16 Jul 2026 in “My thoughts on the future of Go in the AI era” “That is a lot of great tooling working to make things more secure in the Go ecosystem.”
Comment from 24 May 2026 in “Using HTTP/2 Cleartext for a server in Go 1.24” “The Go ecosystem has achieved something amazing here with govulncheck”
Comment from 26 Nov 2025 in “Launching the Julia Security Working Group” - Comment from 2 Mar 2026 in “Go is the best language for agents”
- Comment from 20 Feb 2026 in “Turn Dependabot Off”
Combines static and dynamic analysis
“Static and dynamic analysis of binaries for free, built into the language ecosystem itself”
Comment from 16 Jul 2026 in “My thoughts on the future of Go in the AI era” “offers a novel dynamic/static analysis hybrid approach to vulnerability management”
Comment from 26 Jun 2026 in “Migrating from Proxmox to NixOS and Incus”
Other vulnerability scanners people recommend
The four most recommended other vulnerability scanners, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| OpenAI Codex Security | 21 | 30 | 41% | 4 | — | — |
| govulncheckThis page | 13 | 0 | 100% | 9 | — | Approved |
| AISLE | 11 | 2 | 85% | 5 | — | Approved |
| Trivy | 10 | 23 | 30% | 5 | — | — |
| cargo-vet | 8 | 0 | 100% | 5 | — | — |
What people said
All 17 comments that mention it, newest first. Each links to the original comment.
“govulncheck tells me if my codebase is actually affected by CVEs or not”
“go lang has a scanner which only shows issues when the code actually calls the effected functions”
“Static and dynamic analysis of binaries for free, built into the language ecosystem itself”
“offers a novel dynamic/static analysis hybrid approach to vulnerability management”
“That is a lot of great tooling working to make things more secure in the Go ecosystem.”
“It works OK as a commit hook, it runs quickly enough”
“it significantly enhances Go's maintainability for large projects”
“it does call flow analysis and won't claim you're vulnerable just because you used a module”
“The govulncheck tool has first-class support in the Go ecosystem.”
“Govulncheck is good, but not without false-positives.”
“govulncheck is the much better answer and we use it.”
“tracing actual code paths to verify vulnerable functions are called”
“static analysis like govulncheck is the secret weapon to success”
“it actually traces call paths so you only get alerted if the vulnerable function is reachable from your code”
“we don't have a way, right now, of ingesting better data sources like `govulncheck`”
“Govulncheck is one of the Go ecosystem's best features”
“The Go ecosystem has achieved something amazing here with govulncheck”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.