No. 19 of 65 ·Software Composition Analysis Software

govulncheck

Linux

Freedom report

Two barsScore 6.3

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely1 of 6 device platforms
DocumentedPlans, terms and facts published

govulncheck is ranked #19 of 65 in software composition analysis software on Freedom251. It runs on Linux. There is a free plan.

govulncheck plans and pricing

All plans

Govulncheck Free Go source code or binaries · Go vulnerability database pkg.go.dev · 5 Oct 2026

Compared on software composition analysis software

Supported ecosystems: Go
SBOM generation: Yes
Reachability analysis: Yes
Deployment options: self_hosted

Best govulncheck alternatives

See all 20

Two bars Snyk Open Source Free tier No. 1$25/mo6.7 Two bars Sonatype Nexus Repository Free tier No. 2$162.50/mo6.7 Two bars Accessibility Test Framework for Android Free tier No. 3Free6.6 Two bars Docker Desktop Free tier No. 4$9/mo6.6 Two bars Endor Labs Free tier No. 5Free6.6 Two bars OpenSCA Free tier No. 6Free6.6

The record

Purpose: Govulncheck reports known vulnerabilities that affect Go code.
Install: The Go docs show installing it with `go install golang.org/x/vuln/cmd/govulncheck@latest`.
Binary scanning: It can scan compiled Go binaries using their symbol information, but binary results omit call stacks.
Editor integration: The Go language server gopls integrates govulncheck analysis, and the Go docs describe use with VS Code and Vim or NeoVim via coc.nvim.
Output formats: Govulncheck supports streaming JSON, SARIF, and OpenVEX output.
Vulnerability data: By default it uses the Go vulnerability database, whose reports use the OSV schema and are reviewed and curated by the Go Security team.
Privacy: The package documentation says database requests contain only module paths for vulnerabilities already known to the database, not code or other properties of the program.
Custom database: The `-db` flag can point govulncheck to a different database using HTTP, HTTPS, or file URLs, provided it implements the documented API.
Analysis limits: Reflection calls are not visible to source analysis, and use of `unsafe` may cause false negatives.
Binary limits: Binaries built with Go versions before 1.18 are checked only for standard library vulnerabilities.
Editor limits: The documented editor scanning features currently do not report vulnerabilities in standard libraries or toolchains.
Project status: The Go vulnerability management project is described as a work in progress and under active development.
Support: The Go docs direct govulncheck issues and feedback to the Go issue tracker.
Price from: Free

Where it ranks on Freedom251

Best Software Composition Analysis Software in 2026#19 of 65

Is govulncheck yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote govulncheck

Sources

pkg.go.dev/golang.org/x/vuln/cmd/govulncheck· checked 5 Oct 2026
go.dev/doc/security/vuln/· checked 5 Oct 2026
go.dev/doc/security/vuln/editor· checked 5 Oct 2026
go.dev/doc/security/vuln/database· checked 5 Oct 2026