---
updatedAt: 2026-10-05T13:25:05.000Z
agentTools:
  siteIndex: https://docs.jfrog.com/llms.txt
  projectIndex: https://docs.jfrog.com/security/llms.txt
---

# Go

Review Go source code and binary scanning support in JFrog Xray.

## Introduction

JFrog Xray provides security and compliance analysis for Go applications throughout the software development lifecycle. This page describes the supported scan contexts, capabilities, and dependency analysis available for Go.

***

## Capabilities

The following capabilities are available for Go.

| Capability                    | Source Code Scanning                                                                                                                           | Binary Scanning                                                                                                                                |
| ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| Vulnerability Matching (CVEs) | ![YES](https://files.readme.io/fc1c18cf90fcc1f4c89ab6c76cb2ba6eb15a987c4e30403d7d4b0843fe5ab945-uuid-ea92c1e1-5d79-3981-c8d5-5a5d13efa637.svg) | ![YES](https://files.readme.io/fc1c18cf90fcc1f4c89ab6c76cb2ba6eb15a987c4e30403d7d4b0843fe5ab945-uuid-ea92c1e1-5d79-3981-c8d5-5a5d13efa637.svg) |
| License Detection             | ![YES](https://files.readme.io/fc1c18cf90fcc1f4c89ab6c76cb2ba6eb15a987c4e30403d7d4b0843fe5ab945-uuid-ea92c1e1-5d79-3981-c8d5-5a5d13efa637.svg) | ![YES](https://files.readme.io/fc1c18cf90fcc1f4c89ab6c76cb2ba6eb15a987c4e30403d7d4b0843fe5ab945-uuid-ea92c1e1-5d79-3981-c8d5-5a5d13efa637.svg) |
| Malicious Package Detection   | ![YES](https://files.readme.io/fc1c18cf90fcc1f4c89ab6c76cb2ba6eb15a987c4e30403d7d4b0843fe5ab945-uuid-ea92c1e1-5d79-3981-c8d5-5a5d13efa637.svg) | ![NO](https://files.readme.io/cb1a718de8cb6ae959e37b0d31653fd1e069dd942db69f0a4add6e73519b7c7f-uuid-558c7cd2-b4b5-9b18-93a6-68ac49d53c0f.svg)  |
| Operational Risk              | ![NO](https://files.readme.io/cb1a718de8cb6ae959e37b0d31653fd1e069dd942db69f0a4add6e73519b7c7f-uuid-558c7cd2-b4b5-9b18-93a6-68ac49d53c0f.svg)  | ![NO](https://files.readme.io/cb1a718de8cb6ae959e37b0d31653fd1e069dd942db69f0a4add6e73519b7c7f-uuid-558c7cd2-b4b5-9b18-93a6-68ac49d53c0f.svg)  |
| Smart Remediation             | 🔜                                                                                                                                             | 🔜                                                                                                                                             |

***

<Tabs>
  <Tab title="Source Code Scanning">
    Source code scanning analyzes your project's dependency manifest files to identify components and their vulnerabilities. You can use it with the JFrog CLI `jf audit` command, [Frogbot](/docs/frogbot), IDE integrations, and CI pipelines. For more information, see [Scan Your Source Code](/docs/scan-your-source-code).

    Which files a source scan reads depends on the scan method. For those differences, see [Source Scanning Engines and Frogbot Versions](/docs/source-scanning-engines-and-frogbot-versions).

    ### Supported Files

    | Package Manager | Supported Files | Available with |
    | --------------- | --------------- | -------------- |
    | Go Modules      | `go.mod`, `go.sum` (required) | Default `jf audit` |
    | Go Modules      | `go.mod`, `go.sum` – Direct/indirect via `// indirect` comments, replace directives honored, stdlib detection, Go 1.11+ | Frogbot V3 |

    ### Dependency Graph

    | Package Manager | Dependency Graph |
    | --------------- | ---------------- |
    | Go Modules      | ⚠️ Flat Dependency list |
  </Tab>

  <Tab title="Binary Scanning">
    Binary scanning analyzes built artifacts stored in JFrog Artifactory repositories, extracting package metadata from the artifact format itself. For more information, see [Scan Your Binaries](/docs/scan-your-binaries).

    ### Supported Files

    The following files are supported for Go binary scanning.

    | Package Manager | Supported Files    |
    | --------------- | ------------------ |
    | Go              | Go module archives |
  </Tab>
</Tabs>

***

## Additional Information

* Go source code scanning requires Go installed in your environment.
* The `go.sum` file must be present for accurate dependency scanning.
* You can run `go mod tidy` to ensure all dependencies are correctly listed.

## Related Topics

<br />