Go's official vulnerability tooling works at the function level. It reports a vulnerability only when your code transitively calls a vulnerable function, and the Go database deliberately omits severity scores. Comparing a Go scan with a scan of another language by raw counts is therefore misleading.
What the Go project documents
The Go security pages say govulncheck "analyzes your codebase and only surfaces vulnerabilities that actually affect you, based on which functions in your code are transitively calling vulnerable functions." The Go vulnerability database holds reports in the OSV format, and each entry is reviewed so that the description, package and symbol information and version details are accurate.
The same page explains a design choice. The database has no severity labels, because "the impact of a vulnerability is rarely universal, which means that severity indicators can often be deceptive."
The page also says the project is under active development. We could not confirm from it whether the tool covers standard library issues or compiled binaries, so check the current documentation before you rely on either.
Three consequences for buyers
Counts are not comparable. A tool that lists every advisory for every module in go.mod will show more rows than one that filters by reachability. Neither is wrong. They answer different questions: what is present, and what can run.
Severity must come from somewhere else. With no score in the source data, a scanner either leaves the field empty, borrows a score from another database, or computes its own. Ask which one, because it changes how you sort and gate.
Reachability can hide risk you still own. A vulnerable function you do not call today may be called after the next refactor. Keep the inventory view even when you act on the reachable view.
How to compare two Go scans fairly
- Scan the same commit with both tools and record the module list each one found.
- Separate findings into "present in a dependency" and "called from your code".
- For each difference, open the advisory and read the affected symbols.
- Record how each tool assigns severity.
For the general method, see what makes a fair scanner test.
Where Safeguard fits
Safeguard offers reachability analysis alongside dependency scanning, so you can view both what is present and what is called, and try a manifest with the free scan at https://gold.safeguard.sh/scan.
Try it yourself
Open the demo and toggle between all findings and reachable findings. Watch how the list shrinks and which entries remain.
Click through it at your own pace, or open it full screen.
Quick check
Does the Go vulnerability database include severity scores?
No. The Go project states that it intentionally omits them because severity depends on how a package is used.
Why might two Go scanners show different counts?
One may list every advisory on every module while the other filters to functions your code calls. Compare on the same commit and read the advisory symbols.
Sources
Last reviewed: 19 October 2026.
