Govulncheck reports known vulnerabilities in Go source code and compiled
Go binaries. Source analysis identifies calls to vulnerable functions
to reduce reports about unused vulnerable code.

Building requires google-go-lang (Go 1.26 or newer). The supplied vendor
archive allows offline compilation without downloading dependencies.

Run "govulncheck ./..." inside a Go module. Source analysis needs a Go
toolchain compatible with the project and its dependencies. Missing
project modules may need to be downloaded before scanning.

Use "govulncheck -mode=binary PROGRAM" to scan a compiled Go executable.
Binary scanning provides less precise reachability information than
source analysis.

Scans normally query https://vuln.go.dev. Offline builds do not make
scanning offline. A local vulnerability database can be selected with
"-db file:///absolute/path/to/database". Database contents and updates
are not included in this package.

Govulncheck participates in Go telemetry. See "go help telemetry" for
collection and upload controls and https://vuln.go.dev/privacy for
the vulnerability database privacy policy.