{"slug": "govulncheck", "name": "govulncheck", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 2, "commenters": 3, "warners": 0, "score": 1.992, "rising": -0.65, "first": "2026-02-20", "latest": "2026-08-27", "why": "govulncheck is the much better answer and we use it.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 2, "neutral": 1, "compare": 0, "warn": 0}, "spark": [0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0], "listed": false, "loved": [], "caveat": "", "short_quote": "govulncheck is the much better answer and we use it.", "icon": false, "domain": null, "github_repo": null, "official_url": "", "pricing": "", "aliases": ["govulncheck"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 753526832, "item_id": 47095427, "url": "https://news.ycombinator.com/item?id=47095427", "by": "adamdecaf", "date": "2026-02-20", "stance": "recommend", "quote": "govulncheck is the much better answer and we use it.", "excerpt": "govulncheck is the much better answer and we use it. We also let renovate[bot] (similar to dependabot) merge non-major dep updates if tests pass. I hardly notice when deps have small updates. https://github.com/search?q=org%3Amoov-io+is%3Apr+is%3Amerged+sort%3Anewest+author%3Arenovate%5Bbot%5D&type=pullrequests&s=created&o=desc", "context": "", "use_case": "vulnerability checking", "switched_from": "", "story": "Turn Dependabot Off"}, {"id": 753512304, "item_id": 47094519, "url": "https://news.ycombinator.com/item?id=47094519", "by": "samhclark", "date": "2026-02-20", "stance": "recommend", "quote": "I guess I'll start hunting for the equivalent of `govulncheck` for Rust/Cargo.", "excerpt": "This makes sense to me. I guess I'll start hunting for the equivalent of `govulncheck` for Rust/Cargo. Separately, I love the idea of the `geomys/sandboxed-step` action, but I've got such an aversion to use anyone else's actions, besides the first-party `actions/*` ones. I'll give sandboxed-step a look, sounds like it would be a nice thing to keep in my toolbox.", "context": "", "use_case": "vulnerability checking", "switched_from": "", "story": "Turn Dependabot Off"}]}], "caveats": [], "who": [{"by": "K0IN", "context": "team with PR review process", "url": "https://news.ycombinator.com/item?id=49467605", "date": "2026-08-27"}], "tags": [], "use_cases": ["vulnerability checking", "go vulnerability checking"], "compared": [{"slug": "dependabot", "name": "Dependabot", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=47094192", "title": "Turn Dependabot Off", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49444984", "title": "Ask HN: How do you code review?", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {"recommend": 2}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {"neutral": 1}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 791481683, "item_id": 49467605, "url": "https://news.ycombinator.com/item?id=49467605", "by": "K0IN", "date": "2026-08-27", "stance": "neutral", "quote": "linters (for go: gosec,govuln)", "excerpt": "first the automated part, that makes a pr \"review ready\", this helps us alot to gain confidence. 1. Automated tests that actually test real cases 2. Automated tests to test for regressions 3. Automated end-to-end tests, to make sure all core functions (and new functions still work and ui flows are stable / correct) 4. automated ai reviews (we use strix for security and a small Copilot SDK harness) 5. linters (for go:", "context": "team with PR review process", "use_case": "Go vulnerability checking", "switched_from": "", "story": "Ask HN: How do you code review?"}, {"id": 753526832, "item_id": 47095427, "url": "https://news.ycombinator.com/item?id=47095427", "by": "adamdecaf", "date": "2026-02-20", "stance": "recommend", "quote": "govulncheck is the much better answer and we use it.", "excerpt": "govulncheck is the much better answer and we use it. We also let renovate[bot] (similar to dependabot) merge non-major dep updates if tests pass. I hardly notice when deps have small updates. https://github.com/search?q=org%3Amoov-io+is%3Apr+is%3Amerged+sort%3Anewest+author%3Arenovate%5Bbot%5D&type=pullrequests&s=created&o=desc", "context": "", "use_case": "vulnerability checking", "switched_from": "", "story": "Turn Dependabot Off"}, {"id": 753512304, "item_id": 47094519, "url": "https://news.ycombinator.com/item?id=47094519", "by": "samhclark", "date": "2026-02-20", "stance": "recommend", "quote": "I guess I'll start hunting for the equivalent of `govulncheck` for Rust/Cargo.", "excerpt": "This makes sense to me. I guess I'll start hunting for the equivalent of `govulncheck` for Rust/Cargo. Separately, I love the idea of the `geomys/sandboxed-step` action, but I've got such an aversion to use anyone else's actions, besides the first-party `actions/*` ones. I'll give sandboxed-step a look, sounds like it would be a nice thing to keep in my toolbox.", "context": "", "use_case": "vulnerability checking", "switched_from": "", "story": "Turn Dependabot Off"}]}