Vulnerability Management for Go
summary
Go builds a vulnerability pipeline: a curated Go Vulnerability Database at vuln.go.dev, static analysis tool govulncheck, CI GitHub Action and VS Code integration. Comparing go.mod to the database naively shows 15 vulnerabilities but static analysis finds only 2 that are actually reachable and provides stack traces to the exact lines. The database aggregates CVEs and GitHub advisories, maintainers can submit reports, and the tooling is already usable in terminal, editor and CI.
AI-written summary · about
chapters (11)
- 0:00Welcome
- 1:54Software vulnerabilities
- 3:41Software supply chain attacks
- 6:50Protecting supply chain
- 9:14Dependency vulnerability alerts
- 11:21Go vulnerability database
- 13:46Reducing false positives
- 15:53Introducing go vulncheck
- 17:58Vulnerability scanning workflows
- 19:42Editor support for checks
- 20:22Future of vulnerability management
related talks
24mVulnerability Management for Go
32mSecure and reliable development with Go
25mExploring Some Essential Security Checks for Any Open Source Go Project
07mSecurity of Go Modules and Vulnerability Scanning in GoCenter
45mEssential security checks for your Go project
31mGo Security – Past, Present, and Future
22mSecuring Containers Against Known Go Vulnerabilities
42mGo Module Hygiene: Keeping go.sum and go.mod in check