Side by side

depproof vs govulncheck

Both stand on software composition analysis software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.

depproof

Free plan Self-hosted

depproof combines dependency vulnerability and license checks with self-hosted data handling. The free Scanner covers core analysis, while the optional Hub adds organization-wide governance features at custom pricing.

Visit depproof

govulncheck

Free plan Linux

govulncheck provides focused vulnerability analysis for Go source and binaries, with several machine-readable outputs and editor connections. Its analysis boundaries mean results should be interpreted within the stated limits.

Visit govulncheck

The facts

	depproof	govulncheck
Free plan	Yes	Yes
Open source	Not published	Not published
Runs on	Self-hosted	Linux
Lowest paid plan	Free or on request	Free or on request
Plans published	2	1
Maker	Not published	Not published
Website	depproof.com	go.dev
On software composition analysis software	#21 of 65	#25 of 65

depproof: what it does well

Self-hosted deployment
Generates HTML reports and CycloneDX SBOMs
GitHub Action and container options
Does not send scan data externally
Supports multiple dependency ecosystems

What to know first

Does not scan container packages
Does not scan operating-system packages
Hub pricing is custom
Priority support applies to larger Scanner licenses

govulncheck: what it does well

Free, open-source vulnerability scanning for Go
Focuses reports on potentially reachable vulnerabilities
Supports JSON, SARIF, and OpenVEX output
Integrates with gopls and documented editors
Can scan compiled binaries and generate SBOMs

What to know first

Reflection calls are invisible to source analysis
Use of unsafe may cause false negatives
Older binaries get only standard-library checks
Editor scanning omits standard libraries and toolchains

Alternatives to depproof Alternatives to govulncheck The whole list