Don’t forget govulcheck. Static and dynamic analysis of binaries for free, built into the language ecosystem itself: https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck