Survey of Open-Source Security Vulnerability Scanning Tools Written in Go

There are many excellent open-source security vulnerability scanning tools and related projects developed in Go. These tools leverage Go's high performance, concurrency, and cross-platform capabilities, and are widely used in code auditing, network scanning, container security, and more. Below is a list of mainstream projects based on recent research from GitHub, Reddit, and security communities (as of September 2025). The focus is on vulnerability scanning tools, with brief descriptions, GitHub links, and use cases. Popular and actively maintained projects (generally 1k+ GitHub stars) are prioritized.

1. Major Vulnerability Scanners

These tools focus on identifying vulnerabilities in systems, networks, dependencies, or code, and support automated CI/CD integration.

• OSV-Scanner (Google official)
Efficient vulnerability scanner that detects known vulnerabilities in open-source project dependencies (based on the OSV database). Supports multiple package managers (e.g., Go modules, npm) and outputs JSON reports for automation. GitHub: https://github.com/google/osv-scanner (Star: 3k+) Use case: software supply chain security, scanning Go project dependencies. Easy install: go install github.com/google/osv-scanner/cmd/osv-scanner@latest.
• Nuclei (ProjectDiscovery)
High-performance, template-driven vulnerability scanner with custom YAML rules for fast detection of web, network, and API vulnerabilities. Concurrent execution reaches thousands of requests per second. GitHub: https://github.com/projectdiscovery/nuclei (Star: 10k+) Use case: penetration testing and large-scale automated scanning, e.g. nuclei -t cves/ -target example.com. Added AI rule-generation support in 2025.
• Trivy (Aqua Security)
Versatile scanner for container images, filesystems, Git repositories, and OS packages, with SBOM generation and CVE matching. GitHub: https://github.com/aquasecurity/trivy (Star: 20k+) Use case: DevSecOps pipelines, e.g. scanning Docker images: trivy image nginx:latest. Lightweight, agentless.
• Vuls (future-architect)
Agentless vulnerability scanner for Linux/FreeBSD, scanning known CVEs and generating reports with multi-database sync support. GitHub: https://github.com/future-architect/vuls (Star: 5k+) Use case: server and cloud instance auditing; agentless design reduces deployment overhead.
• Grype (Anchore)
Container and filesystem vulnerability scanner integrating the Syft SBOM tool, supporting multi-language package management. GitHub: https://github.com/anchore/grype (Star: 2k+) Use case: Kubernetes environments, quick CI/CD integration.

2. Code Security Checks (SAST / Static Analysis)

These projects focus on scanning Go source code for security issues such as injection flaws and weak cryptography.

• Gosec
Go static security checker that analyzes AST and SSA code to detect common vulnerabilities like SQL injection and hardcoded secrets. Integrates with golangci-lint. GitHub: https://github.com/securego/gosec (Star: 6k+) Use case: code review, e.g. gosec ./.... Recommended by the Go official ecosystem.
• GitLeaks
Scans Git repositories for hardcoded secrets (API keys, passwords) with custom rule support. GitHub: https://github.com/gitleaks/gitleaks (Star: 15k+) Use case: pre-commit hooks to prevent sensitive information leaks.

3. Other Security-Related Projects

Broader security tools that complement vulnerability scanning, such as network reconnaissance or policy engines.

• Amass (OWASP)
Deep DNS enumeration and network mapping tool for subdomain discovery and OSINT. GitHub: https://github.com/owasp-amass/amass (Star: 10k+) Use case: pre-hunt intelligence gathering.
• Bettercap
Network reconnaissance and MITM attack framework supporting WiFi/BLE/Ethernet. GitHub: https://github.com/bettercap/bettercap (Star: 15k+) Use case: wireless network vulnerability testing.
• Open Policy Agent (OPA)
General-purpose policy engine for unified policy enforcement across microservices and Kubernetes security. GitHub: https://github.com/open-policy-agent/opa (Star: 10k+) Use case: access control in zero-trust architectures.

Recommendations and Notes

• For beginners: Start with OSV-Scanner or Trivy—they are easy to use and cover supply chain/container scenarios. Combine with Gosec for code-level checks.
• Resource list: See Awesome Go Security for a full directory (50+ projects).
• Official Go support: Go 1.21+ has built-in vulnerability management (the go vuln command) that complements these tools.
• Trends: In 2025, these tools emphasize AI assistance (e.g., Nuclei's rule optimization) and SBOM integration, with active communities on GitHub and X.