Open-Source Vulnerability Scanners Built in Go: A Survey of Key Projects

There are many excellent open-source security vulnerability scanners and related projects built in Go. These tools leverage Go's high performance, concurrency, and cross-platform capabilities, and are widely used in code auditing, network scanning, and container security. Below is a roundup based on research from GitHub, Reddit, and the cybersecurity community (as of September 2025), prioritizing popular and actively maintained projects (1k+ stars), with a focus on vulnerability scanners.

1. Major Vulnerability Scanners

These tools focus on identifying vulnerabilities in systems, networks, dependencies, or code, and support automated integration into CI/CD pipelines.

• OSV-Scanner (Google)
• Efficient vulnerability scanner detecting known vulnerabilities in open-source project dependencies (based on the OSV database). Supports multiple package managers (e.g., Go modules, npm) and outputs JSON reports for automation.
• GitHub: https://github.com/google/osv-scanner (Stars: 3k+)
• Use case: software supply chain security; scanning Go project dependencies. Install with: go install github.com/google/osv-scanner/cmd/osv-scanner@latest
• Nuclei (ProjectDiscovery)
• High-performance, template-driven vulnerability scanner with custom YAML rules; quickly detects web, network, and API vulnerabilities. Concurrent execution reaches thousands of requests per second.
• GitHub: https://github.com/projectdiscovery/nuclei (Stars: 10k+)
• Use case: penetration testing and large-scale automated scanning, e.g., nuclei -t cves/ -target example.com. 2025 updates added AI rule generation support.
• Trivy (Aqua Security)
• Versatile vulnerability scanner for container images, filesystems, Git repositories, and OS packages; supports SBOM generation and CVE matching.
• GitHub: https://github.com/aquasecurity/trivy (Stars: 20k+)
• Use case: DevSecOps pipelines, e.g., scanning a Docker image: trivy image nginx:latest. Lightweight and agentless.
• Vuls (future-architect)
• Agentless vulnerability scanner for Linux/FreeBSD; scans known CVEs and generates reports. Supports syncing with multiple databases.
• GitHub: https://github.com/future-architect/vuls (Stars: 5k+)
• Use case: server and cloud instance auditing; agentless design reduces deployment overhead.
• Grype (Anchore)
• Container and filesystem vulnerability scanner, integrates with the Syft SBOM tool and supports multi-language package management.
• GitHub: https://github.com/anchore/grype (Stars: 2k+)
• Use case: Kubernetes environments; quick CI/CD integration.

2. Code Security Tools (SAST / Static Analysis)

These projects focus on scanning Go source code for security issues such as injection flaws and weak cryptography.

• Gosec
• Static security checker for Go; analyzes AST and SSA code to detect common vulnerabilities like SQL injection and hardcoded secrets. Integrates with golangci-lint.
• GitHub: https://github.com/securego/gosec (Stars: 6k+)
• Use case: code review, e.g., gosec ./.... Recommended by the Go project.
• GitLeaks
• Scans Git repositories for hardcoded secrets (API keys, passwords) with support for custom rules.
• GitHub: https://github.com/gitleaks/gitleaks (Stars: 15k+)
• Use case: pre-commit hooks to prevent sensitive information leakage.

3. Other Security-Related Projects

Broader security tools that complement vulnerability scanning, such as network reconnaissance or policy engines.

• Amass (OWASP)
• Deep DNS enumeration and network mapping tool for subdomain discovery and OSINT.
• GitHub: https://github.com/owasp-amass/amass (Stars: 10k+)
• Use case: intelligence gathering prior to bug hunting.
• Bettercap
• Network reconnaissance and MITM attack framework supporting WiFi/BLE/Ethernet.
• GitHub: https://github.com/bettercap/bettercap (Stars: 15k+)
• Use case: wireless network vulnerability testing.
• Open Policy Agent (OPA)
• General-purpose policy engine for unified policy enforcement; supports microservices and Kubernetes security.
• GitHub: https://github.com/open-policy-agent/opa (Stars: 10k+)
• Use case: access control in zero-trust architectures.

Recommendations and Notes

• Getting started: Begin with OSV-Scanner or Trivy—they are easy to use and cover supply chain/container scenarios. Combine with Gosec for code-level checks.
• Resource list: See Awesome Go Security for a full catalog (50+ projects).
• Official Go support: Go 1.21+ includes built-in vulnerability management (the go vuln command), complementary to these tools.
• Trends: In 2025, these tools emphasize AI assistance (e.g., Nuclei's rule optimization) and SBOM integration, with active communities on GitHub and X.