[brainphreeze]

Has anyone tested this? I'm testing it on a project with known vulnerabilities and am getting positive matches when testing against a go binary (govulncheck binary), but not when ran within a directory using: govulncheck .

[ainar-g]

The pattern to check the package and all subpackages for pretty much all Go tools is "./...". So:

  govulncheck ./...