Skip to main content

Go

Vulkro does source analysis for Go. It finds your HTTP endpoints, tracks request data through your code to dangerous sinks, and checks your go.mod dependencies against a local CVE bundle.

Go is in the Free tier. You still need an account and sign-in to scan. See Accounts.

Project detection​

Vulkro spots a Go project from go.mod and resolves module versions using minimal version selection over the require block.

vulkro scan .
vulkro discover .

Frameworks​

Vulkro extracts endpoints from:

  • net/http
  • Gin
  • Echo
  • Chi
  • Fiber
  • gorilla/mux

Access model​

Every endpoint is tagged with an AuthTier, its scopes, and its tenant-scoping. This is the same model Vulkro builds for the other languages, and it feeds the OWASP API Top 10 checks. See OWASP API Top 10.

Taint analysis​

Vulkro follows request data through function calls to dangerous sinks.

Sources include r.URL.Query(), r.PostFormValue, r.Header.Get, and router path parameters. Sinks include SQL query construction, os/exec command execution, filesystem paths, and outbound request URLs (SSRF). Each finding shows the source-to-sink hop chain.

There are also Go-specific detectors: a zip-slip check and CRLF / response-header injection for net/http (w.Header().Set/Add, http.Redirect, http.SetCookie). See New detectors.

Dependencies​

Vulkro matches go.mod dependencies against the local CVE bundle (OSV Go ecosystem). The leading v is stripped to match OSV's version format.

Go modules are not in the reachability set, so Go CVE findings come without a [reachable] / [unreachable] tag. See Dependencies and CVEs.

Detection-depth gap (published)​

Go detection depth is a known gap, and Vulkro publishes it rather than hiding it. On the benchmark's one Go repository (govwa), Vulkro currently finds 0 of 4 catalogued bugs while gosec finds 3. The misses (an fmt.Sprintf SQL interpolation, an html/template XSS, and two HttpOnly: false insecure cookies) stay in the corpus as false negatives. If Go is your primary language, run gosec alongside Vulkro today. The full numbers are on the Benchmark page.

Useful commands​

vulkro scan .
vulkro discover . --format json
vulkro dataflow .
vulkro explain GO-TAINT-SQL-001
Last updated on