diff --git a/vulndb/internal/audit/vulnerability.go b/vulndb/internal/audit/vulnerability.go
index 600b193..50113f9 100644
--- a/vulndb/internal/audit/vulnerability.go
+++ b/vulndb/internal/audit/vulnerability.go
@@ -5,6 +5,11 @@
 package audit
 
 import (
+	"go/build"
+	"os"
+	"path/filepath"
+	"strings"
+
 	"golang.org/x/tools/go/packages"
 	"golang.org/x/vulndb/client"
 )
@@ -17,6 +22,13 @@
 		if mod.Replace != nil {
 			modPath = mod.Replace.Path
 		}
+
+		// skip loading vulns for local imports
+		if isLocal(mod) {
+			// TODO: what if client has its own db
+			// with local vulns?
+			continue
+		}
 		vulns, err := client.Get(modPath)
 		if err != nil {
 			return nil, err
@@ -31,3 +43,23 @@
 	}
 	return mv, nil
 }
+
+func isLocal(mod *packages.Module) bool {
+	modDir := mod.Dir
+	if mod.Replace != nil {
+		modDir = mod.Replace.Dir
+	}
+	return !strings.HasPrefix(modDir, modCacheDirectory())
+}
+
+func modCacheDirectory() string {
+	var modCacheDir string
+	// TODO: define modCacheDir using cmd/go/internal/cfg.GOMODCACHE
+	if modCacheDir = os.Getenv("GOMODCACHE"); modCacheDir == "" {
+		if modCacheDir = os.Getenv("GOPATH"); modCacheDir == "" {
+			modCacheDir = build.Default.GOPATH
+		}
+		modCacheDir = filepath.Join(modCacheDir, "pkg", "mod")
+	}
+	return modCacheDir
+}
diff --git a/vulndb/internal/audit/vulnerability_test.go b/vulndb/internal/audit/vulnerability_test.go
index 6a01e83..6a3346f 100644
--- a/vulndb/internal/audit/vulnerability_test.go
+++ b/vulndb/internal/audit/vulnerability_test.go
@@ -26,13 +26,15 @@
 			"example.mod/a": {{ID: "a", Affected: []osv.Affected{{Package: osv.Package{Name: "example.mod/a"}, Ranges: osv.Affects{{Type: osv.TypeSemver, Events: []osv.RangeEvent{{Fixed: "2.0.0"}}}}}}}},
 			"example.mod/b": {{ID: "b", Affected: []osv.Affected{{Package: osv.Package{Name: "example.mod/b"}, Ranges: osv.Affects{{Type: osv.TypeSemver, Events: []osv.RangeEvent{{Fixed: "1.1.1"}}}}}}}},
 			"example.mod/d": {{ID: "c", Affected: []osv.Affected{{Package: osv.Package{Name: "example.mod/d"}, Ranges: osv.Affects{{Type: osv.TypeSemver, Events: []osv.RangeEvent{{Fixed: "2.0.0"}}}}}}}},
+			"example.mod/e": {{ID: "e", Affected: []osv.Affected{{Package: osv.Package{Name: "example.mod/e"}, Ranges: osv.Affects{{Type: osv.TypeSemver, Events: []osv.RangeEvent{{Fixed: "2.2.0"}}}}}}}},
 		},
 	}
 
 	mv, err := FetchVulnerabilities(mc, []*packages.Module{
-		{Path: "example.mod/a", Version: "v1.0.0"},
-		{Path: "example.mod/b", Version: "v1.0.4"},
-		{Path: "example.mod/c", Replace: &packages.Module{Path: "example.mod/d", Version: "v1.0.0"}, Version: "v2.0.0"},
+		{Path: "example.mod/a", Dir: modCacheDirectory(), Version: "v1.0.0"},
+		{Path: "example.mod/b", Dir: modCacheDirectory(), Version: "v1.0.4"},
+		{Path: "example.mod/c", Replace: &packages.Module{Path: "example.mod/d", Dir: modCacheDirectory(), Version: "v1.0.0"}, Version: "v2.0.0"},
+		{Path: "example.mod/e", Replace: &packages.Module{Path: "../local/example.mod/d", Dir: modCacheDirectory(), Version: "v1.0.1"}, Version: "v2.1.0"},
 	})
 	if err != nil {
 		t.Fatalf("FetchVulnerabilities failed: %s", err)
@@ -40,19 +42,19 @@
 
 	expected := ModuleVulnerabilities{
 		{
-			mod: &packages.Module{Path: "example.mod/a", Version: "v1.0.0"},
+			mod: &packages.Module{Path: "example.mod/a", Dir: modCacheDirectory(), Version: "v1.0.0"},
 			vulns: []*osv.Entry{
 				{ID: "a", Affected: []osv.Affected{{Package: osv.Package{Name: "example.mod/a"}, Ranges: osv.Affects{{Type: osv.TypeSemver, Events: []osv.RangeEvent{{Fixed: "2.0.0"}}}}}}},
 			},
 		},
 		{
-			mod: &packages.Module{Path: "example.mod/b", Version: "v1.0.4"},
+			mod: &packages.Module{Path: "example.mod/b", Dir: modCacheDirectory(), Version: "v1.0.4"},
 			vulns: []*osv.Entry{
 				{ID: "b", Affected: []osv.Affected{{Package: osv.Package{Name: "example.mod/b"}, Ranges: osv.Affects{{Type: osv.TypeSemver, Events: []osv.RangeEvent{{Fixed: "1.1.1"}}}}}}},
 			},
 		},
 		{
-			mod: &packages.Module{Path: "example.mod/c", Replace: &packages.Module{Path: "example.mod/d", Version: "v1.0.0"}, Version: "v2.0.0"},
+			mod: &packages.Module{Path: "example.mod/c", Replace: &packages.Module{Path: "example.mod/d", Dir: modCacheDirectory(), Version: "v1.0.0"}, Version: "v2.0.0"},
 			vulns: []*osv.Entry{
 				{ID: "c", Affected: []osv.Affected{{Package: osv.Package{Name: "example.mod/d"}, Ranges: osv.Affects{{Type: osv.TypeSemver, Events: []osv.RangeEvent{{Fixed: "2.0.0"}}}}}}},
 			},