code.govulncheckgovulncheck (Go vulnerabilities)
Runs govulncheck over each Go module. Findings whose vulnerable function is actually called are high-confidence; imported-but-not-called ones are low-confidence and one severity lower. govulncheck loads packages with the Go toolchain (no code is executed, cgo is disabled, toolchain downloads are blocked), so it is opt-in.
- Engine
- Wrapped scanner
- Wraps
govulncheck- Targets
- Codebase
- Areas
- Supply chain, Security
- Runs
- Opt-in: only when selected with --only
- Network
- Contacts services beyond the target
Run only this auditor
bunx openaudit . --only code.govulncheckWraps govulncheck. When it isn't installed, the auditor is skipped with an install hint and the rest of the audit runs.