🔐 Keep your Go dependencies secure, up-to-date, and compliant.

Go Guard is a CLI tool + GitHub Action for scanning Go projects to detect: Vulnerabilities, Outdated dependencies, Unmaintained packages, License risks. It helps developers keep Go projects secure, up-to-date, and compliant with minimal effort.

🚀 Current version: v0.3.0

• 🔍 Scan go.mod / go.sum dependencies
• 🛡️ Detect vulnerable dependencies using Go vulnerability database
• 📦 Check for outdated dependencies via the Go proxy
• 🏚️ Detect unmaintained repos (archived or stale >2 years)
• ⚖️ Identify licenses (via GitHub LICENSE file)
• 📊 Output as table or JSON or HTML
• 🚪 Exit codes for CI pipelines (see below)
• ⏲ Each module gets a RiskScore (numeric) and RiskLevel (Low / Medium / High).

• 0 → All checks passed (OK)
• 1 → Warnings detected (e.g. outdated or risky license or stale repo)
• 2 → Failures detected (vulnerabilities, archived repos)

Use these exit codes in CI/CD pipelines to fail builds on security issues.

go install github.com/AumSahayata/goguard@latest

goguard scan

Outputs a table of all modules, their versions, and issues on the console.

goguard scan --json

goguard scan --json-file result.json

goguard scan --html-file result.html

goguard scan --verbose

goguard scan --strict

Fails even for warnings

name: GoGuard Scan

on:
  pull_request:
    branches: [main]

jobs:
  goguard:
    name: GoGuard
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.24'

      - name: Install goguard
        run: go install github.com/AumSahayata/goguard@latest
      
      - name: Run gogurad
        run: goguard scan --json-file report.json --verbose

[
  {
    "Name": "golang.org/x/mod",
    "Version": "v0.28.0",
    "Latest": "v0.28.0",
    "Vulnerable": false,
    "CVEs": [],
    "Status": "[WARN] License",
    "Issues": "License: Unknown",
    "RiskScore": 2,
    "RiskLevel": "Low"
  },
]

MIT License. See LICENSE for details.

PRs and issues are welcome and feel free to suggest features.