We want to provide a low-noise, reliable way for Go developers to be alerted of known security vulnerabilities that affect their applications.
We aim to build a first-party, curated, consistent database of security vulnerabilities open to community submissions, and static analysis tooling to surface only the vulnerabilities that are likely to affect an application, minimizing false positives.
The primary consumer of the database and the protocol will be a Go tool, tentatively
go audit
, which will analyze a module and report what vulnerabilities it’s affected by.
https://github.com/golang/go/issues/45519https://go.googlesource.com/proposal/+/master/design/draft-vulndb.md