Vulnerability Management for Go
summary
Go vulnerability data aggregates GHSA, NVD/CVE, stdlib fixes and maintainer reports into a curated go vulnerability database and exposes details on vol.go.dev and pkg.go.dev. A static-analysis CLI, govulncheck, traces call stacks to exact lines and turns noisy module-level hits into actionable results (example shown: 15 to 2), plus a GitHub Action and VS Code integration let CI and editors surface fixes and quick-upgrade suggestions tied to fixed versions.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:24Vulnerabilities in software
- 3:29Supply chain security importance
- 4:53Software supply chain attacks
- 8:20Finding Go dependency flaws
- 12:52Goals for Go vulnerability management
- 13:34Go Vulnerability Database
- 15:22Reducing false positives
- 18:30Integrating vulnerability checks
- 21:22Vulnerabilities on pkg.go.dev
- 22:44VS Code vulnerability scanning
- 23:46Future of Go vulnerability management
related talks
21mVulnerability Management for Go
32mSecure and reliable development with Go
31mGo Security – Past, Present, and Future
22mSecuring Containers Against Known Go Vulnerabilities
32mA Vulnerability Database Should Not Be About Vulnerabilities!
25mExploring Some Essential Security Checks for Any Open Source Go Project
45mEssential security checks for your Go project
43mOpen Source Runs the World, Why Not Vulnerability Identifiers?