diff --git a/vulndb/go.mod b/vulndb/go.mod
new file mode 100644
index 0000000..4eed685
--- /dev/null
+++ b/vulndb/go.mod
@@ -0,0 +1,14 @@
+module golang.org/x/exp/vulndb
+
+go 1.17
+
+require (
+	golang.org/x/tools v0.1.4-0.20210618183400-d25f90668280
+	golang.org/x/vulndb v0.0.0-20210616170126-cf0f9f1f871d
+)
+
+require (
+	golang.org/x/mod v0.4.2 // indirect
+	golang.org/x/sys v0.0.0-20210510120138-977fb7262007 // indirect
+	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
+)
diff --git a/vulndb/go.sum b/vulndb/go.sum
new file mode 100644
index 0000000..8889276
--- /dev/null
+++ b/vulndb/go.sum
@@ -0,0 +1,35 @@
+github.com/google/go-cmp v0.5.4 h1:L8R9j+yAqZuZjsqh/z+F1NCffTKKLShY6zXTItVIZ8M=
+github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.2 h1:Gz96sIWK3OalVv/I/qNygP42zyoKp3xptRVCWRFEBvo=
+golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210510120138-977fb7262007 h1:gG67DSER+11cZvqIMb8S8bt0vZtiN6xWYARwirrOSfE=
+golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.4-0.20210618183400-d25f90668280 h1:bvZzMlhjbBrvAqAeuknuBOeOUnTHzR5zqg+y2mrOGKY=
+golang.org/x/tools v0.1.4-0.20210618183400-d25f90668280/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/vulndb v0.0.0-20210616170126-cf0f9f1f871d h1:enPb1wKlBGD6XfVrYlyH6teMbuprkh5Q3rvIlSRTZBc=
+golang.org/x/vulndb v0.0.0-20210616170126-cf0f9f1f871d/go.mod h1:zjTClCE7c55KnXf1MqfecbAQyuVrc24QEcrThAnl3A0=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
diff --git a/vulndb/govulncheck/main.go b/vulndb/govulncheck/main.go
new file mode 100644
index 0000000..ec38f44
--- /dev/null
+++ b/vulndb/govulncheck/main.go
@@ -0,0 +1,224 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Command govulncheck reports known vulnerabilities filed in a vulnerability database
+// (see https://golang.org/design/draft-vulndb) that affect a given package or binary.
+//
+// It uses static analysis or the binary's symbol table to narrow down reports to only
+// those that potentially affect the application.
+//
+// WARNING WARNING WARNING
+//
+// govulncheck is still experimental and neither its output or the vulnerability
+// database should be relied on to be stable or comprehensive. It also performs no
+// caching of vulnerability database entries.
+package main
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"runtime"
+	"sort"
+	"strings"
+
+	"golang.org/x/exp/vulndb/internal/audit"
+	"golang.org/x/exp/vulndb/internal/binscan"
+	"golang.org/x/tools/go/packages"
+	"golang.org/x/tools/go/ssa/ssautil"
+)
+
+var (
+	jsonFlag    = flag.Bool("json", false, "")
+	verboseFlag = flag.Bool("verbose", false, "")
+	importsFlag = flag.Bool("imports", false, "")
+)
+
+const usage = `govulncheck: identify known vulnerabilities by call graph traversal.
+
+Usage:
+
+	govulncheck [-imports] {package pattern...}
+
+	govulncheck {binary path}
+
+Flags:
+
+	-imports   Perform a broad scan with more false positives, which reports all
+	           vulnerabilities found in any transitively imported package, regardless
+	           of whether they are reachable.
+
+	-json  	   Print vulnerability findings in JSON format.
+
+	-verbose   Print progress information.
+
+govulncheck can be used with either one or more package patterns (i.e. golang.org/x/crypto/...
+or ./...) or with a single path to a Go binary. In the latter case module and symbol
+information will be extracted from the binary in order to detect vulnerable symbols
+and the -imports flag is disregarded.
+
+The environment variable GOVULNDB can be set to a comma-separate list of vulnerability
+database URLs, with http://, https://, or file:// protocols. Entries from multiple
+databases are merged.
+`
+
+func main() {
+	flag.Usage = func() { fmt.Fprintln(os.Stderr, usage) }
+	flag.Parse()
+
+	if len(flag.Args()) == 0 {
+		fmt.Fprintln(os.Stderr, usage)
+		os.Exit(1)
+	}
+
+	dbs := []string{"https://storage.googleapis.com/go-vulndb"}
+	if GOVULNDB := os.Getenv("GOVULNDB"); GOVULNDB != "" {
+		dbs = strings.Split(GOVULNDB, ",")
+	}
+
+	cfg := &packages.Config{
+		Mode: packages.LoadAllSyntax | packages.NeedModule,
+	}
+
+	findings, err := run(cfg, flag.Args(), *importsFlag, dbs)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "govulncheck: %s\n", err)
+		os.Exit(1)
+	}
+
+	sort.SliceStable(findings, func(i int, j int) bool { return audit.FindingCompare(findings[i], findings[j]) })
+	presentTo(os.Stdout, findings)
+}
+
+// presentTo pretty-prints findings to out.
+func presentTo(out io.Writer, findings []audit.Finding) {
+	if !*jsonFlag {
+		for _, finding := range findings {
+			finding.Write(out)
+			out.Write([]byte{'\n'})
+		}
+		return
+	}
+	b, err := json.MarshalIndent(findings, "", "\t")
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "govulncheck: %s\n", err)
+		os.Exit(1)
+	}
+	out.Write(b)
+	out.Write([]byte{'\n'})
+}
+
+// allPkgPaths computes a list of all packages, in
+// the form of their paths, reachable from pkgs.
+func allPkgPaths(pkgs []*packages.Package) []string {
+	paths := make(map[string]bool)
+	for _, pkg := range pkgs {
+		pkgPaths(pkg, paths)
+	}
+
+	var ps []string
+	for p := range paths {
+		ps = append(ps, p)
+	}
+	return ps
+}
+
+func pkgPaths(pkg *packages.Package, paths map[string]bool) {
+	if _, ok := paths[pkg.PkgPath]; ok {
+		return
+	}
+	paths[pkg.PkgPath] = true
+	for _, imp := range pkg.Imports {
+		pkgPaths(imp, paths)
+	}
+}
+
+func isFile(path string) bool {
+	s, err := os.Stat(path)
+	if err != nil {
+		return false
+	}
+	return !s.IsDir()
+}
+
+func run(cfg *packages.Config, patterns []string, importsOnly bool, dbs []string) ([]audit.Finding, error) {
+	if len(patterns) == 1 && isFile(patterns[0]) {
+		packages, symbols, err := binscan.ExtractPackagesAndSymbols(patterns[0])
+		if err != nil {
+			return nil, err
+		}
+
+		paths := make([]string, 0, len(packages))
+		for pkg := range packages {
+			paths = append(paths, pkg)
+		}
+
+		vulns, err := audit.LoadVulnerabilities(dbs, paths)
+		if err != nil {
+			return nil, fmt.Errorf("failed to load vulnerability dbs: %v", err)
+		}
+		env := audit.Env{OS: runtime.GOOS, Arch: runtime.GOARCH, PkgVersions: packages, Vulns: vulns}
+
+		return audit.VulnerablePackageSymbols(symbols, env), nil
+	}
+
+	// Load packages.
+	if *verboseFlag {
+		fmt.Println("loading packages...")
+	}
+	pkgs, err := packages.Load(cfg, patterns...)
+	if err != nil {
+		return nil, err
+	}
+	if packages.PrintErrors(pkgs) > 0 {
+		return nil, fmt.Errorf("packages contain errors")
+	}
+	if *verboseFlag {
+		fmt.Printf("\t%d loaded packages\n", len(pkgs))
+	}
+
+	// Load database.
+	if *verboseFlag {
+		fmt.Println("loading database...")
+	}
+	vulns, err := audit.LoadVulnerabilities(dbs, allPkgPaths(pkgs))
+	if err != nil {
+		return nil, fmt.Errorf("failed to load vulnerability dbs: %v", err)
+	}
+
+	if *verboseFlag {
+		fmt.Printf("\t%d known vulnerabilities.\n", len(vulns))
+	}
+
+	// Load package versions.
+	pkgVersions := audit.PackageVersions(pkgs)
+
+	// Load SSA.
+	if *verboseFlag {
+		fmt.Println("building ssa...")
+	}
+	prog, ssaPkgs := ssautil.AllPackages(pkgs, 0)
+	prog.Build()
+	if *verboseFlag {
+		fmt.Println("\tbuilt ssa.")
+	}
+
+	// Compute the findings.
+	if *verboseFlag {
+		fmt.Println("detecting vulnerabilities...")
+	}
+	var findings []audit.Finding
+	env := audit.Env{OS: runtime.GOOS, Arch: runtime.GOARCH, PkgVersions: pkgVersions, Vulns: vulns}
+	if importsOnly {
+		findings = audit.VulnerableImports(ssaPkgs, env)
+	} else {
+		findings = audit.VulnerableSymbols(ssaPkgs, env)
+	}
+	if *verboseFlag {
+		fmt.Printf("\t%d detected findings.\n", len(findings))
+	}
+	return findings, nil
+}
diff --git a/vulndb/govulncheck/main_test.go b/vulndb/govulncheck/main_test.go
new file mode 100644
index 0000000..abe99e9
--- /dev/null
+++ b/vulndb/govulncheck/main_test.go
@@ -0,0 +1,365 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package main
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"io"
+	"io/fs"
+	"net/http"
+	"os"
+	"os/exec"
+	"path"
+	"path/filepath"
+	"runtime"
+	"sort"
+	"strings"
+	"testing"
+
+	"golang.org/x/exp/vulndb/internal/audit"
+	"golang.org/x/tools/go/packages"
+	"golang.org/x/tools/go/packages/packagestest"
+)
+
+// TODO(zpavlinovic): improve integration tests.
+
+// goYamlVuln contains vulnerability info for github.com/go-yaml/yaml package.
+var goYamlVuln string = `[{"ID":"GO-2020-0036","Published":"2021-04-14T12:00:00Z","Modified":"2021-04-14T12:00:00Z","Withdrawn":null,"Aliases":["CVE-2019-11254"],"Package":{"Name":"github.com/go-yaml/yaml","Ecosystem":"go"},"Details":"An attacker can craft malicious YAML which will consume significant\nsystem resources when Unmarshalled.\n","Affects":{"Ranges":[{"Type":"SEMVER","Introduced":"","Fixed":"v2.2.8+incompatible"}]},"References":[{"Type":"code review","URL":"https://github.com/go-yaml/yaml/pull/555"},{"Type":"fix","URL":"https://github.com/go-yaml/yaml/commit/53403b58ad1b561927d19068c655246f2db79d48"},{"Type":"misc","URL":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18496"}],"ecosystem_specific":{"Symbols":["yaml_parser_fetch_more_tokens"],"URL":"https://go.googlesource.com/vulndb/+/refs/heads/main/reports/GO-2020-0036.toml"}},{"ID":"GO-2021-0061","Published":"2021-04-14T12:00:00Z","Modified":"2021-04-14T12:00:00Z","Withdrawn":null,"Package":{"Name":"github.com/go-yaml/yaml","Ecosystem":"go"},"Details":"A maliciously crafted input can cause resource exhaustion due to\nalias chasing.\n","Affects":{"Ranges":[{"Type":"SEMVER","Introduced":"","Fixed":"v2.2.3+incompatible"}]},"References":[{"Type":"code review","URL":"https://github.com/go-yaml/yaml/pull/375"},{"Type":"fix","URL":"https://github.com/go-yaml/yaml/commit/bb4e33bf68bf89cad44d386192cbed201f35b241"}],"ecosystem_specific":{"Symbols":["decoder.unmarshal"],"URL":"https://go.googlesource.com/vulndb/+/refs/heads/main/reports/GO-2021-0061.toml"}}]`
+
+// cryptoSSHVuln contains vulnerability info for golang.org/x/crypto/ssh.
+var cryptoSSHVuln string = `[{"ID":"GO-2020-0012","Published":"2021-04-14T12:00:00Z","Modified":"2021-04-14T12:00:00Z","Withdrawn":null,"Aliases":["CVE-2020-9283"],"Package":{"Name":"golang.org/x/crypto/ssh","Ecosystem":"go"},"Details":"An attacker can craft an ssh-ed25519 or sk-ssh-ed25519@openssh.com public\nkey, such that the library will panic when trying to verify a signature\nwith it.\n","Affects":{"Ranges":[{"Type":"SEMVER","Introduced":"","Fixed":"v0.0.0-20200220183623-bac4c82f6975"}]},"References":[{"Type":"code review","URL":"https://go-review.googlesource.com/c/crypto/+/220357"},{"Type":"fix","URL":"https://github.com/golang/crypto/commit/bac4c82f69751a6dd76e702d54b3ceb88adab236"},{"Type":"misc","URL":"https://groups.google.com/g/golang-announce/c/3L45YRc91SY"}],"ecosystem_specific":{"Symbols":["parseED25519","ed25519PublicKey.Verify","parseSKEd25519","skEd25519PublicKey.Verify","NewPublicKey"],"URL":"https://go.googlesource.com/vulndb/+/refs/heads/main/reports/GO-2020-0012.toml"}},{"ID":"GO-2020-0013","Published":"2021-04-14T12:00:00Z","Modified":"2021-04-14T12:00:00Z","Withdrawn":null,"Aliases":["CVE-2017-3204"],"Package":{"Name":"golang.org/x/crypto/ssh","Ecosystem":"go"},"Details":"By default host key verification is disabled which allows for\nman-in-the-middle attacks against SSH clients if\n[ClientConfig.HostKeyCallback] is not set.\n","Affects":{"Ranges":[{"Type":"SEMVER","Introduced":"","Fixed":"v0.0.0-20170330155735-e4e2799dd7aa"}]},"References":[{"Type":"code review","URL":"https://go-review.googlesource.com/38701"},{"Type":"fix","URL":"https://github.com/golang/crypto/commit/e4e2799dd7aab89f583e1d898300d96367750991"},{"Type":"misc","URL":"https://github.com/golang/go/issues/19767"},{"Type":"misc","URL":"https://bridge.grumpy-troll.org/2017/04/golang-ssh-security/"}],"ecosystem_specific":{"Symbols":["NewClientConn"],"URL":"https://go.googlesource.com/vulndb/+/refs/heads/main/reports/GO-2020-0013.toml"}}]`
+
+// k8sAPIServerVuln contains vulnerability info for k8s.io/apiextensions-apiserver/pkg/apiserver.
+var k8sAPIServerVuln string = `[{"ID":"GO-2021-0062","Published":"2021-04-14T12:00:00Z","Modified":"2021-04-14T12:00:00Z","Withdrawn":null,"Aliases":["CVE-2019-11253"],"Package":{"Name":"k8s.io/apiextensions-apiserver/pkg/apiserver","Ecosystem":"go"},"Details":"A maliciously crafted YAML or JSON message can cause resource\nexhaustion.\n","Affects":{"Ranges":[{"Type":"SEMVER","Introduced":"","Fixed":"v0.17.0"}]},"References":[{"Type":"code review","URL":"https://github.com/kubernetes/kubernetes/pull/83261"},{"Type":"fix","URL":"https://github.com/kubernetes/apiextensions-apiserver/commit/9cfd100448d12f999fbf913ae5d4fef2fcd66871"},{"Type":"misc","URL":"https://github.com/kubernetes/kubernetes/issues/83253"},{"Type":"misc","URL":"https://gist.github.com/bgeesaman/0e0349e94cd22c48bf14d8a9b7d6b8f2"}],"ecosystem_specific":{"Symbols":["NewCustomResourceDefinitionHandler"],"URL":"https://go.googlesource.com/vulndb/+/refs/heads/main/reports/GO-2021-0062.toml"}}]`
+
+// index for dbs containing some entries for each vuln package.
+// The timestamp for package is set to random moment in the past.
+var index string = `{
+	"k8s.io/apiextensions-apiserver/pkg/apiserver": "2021-01-01T12:00:00.000000000-08:00",
+	"golang.org/x/crypto/ssh": "2021-01-01T12:00:00.000000000-08:00",
+	"github.com/go-yaml/yaml": "2021-01-01T12:00:00.000000000-08:00"
+}`
+
+var vulns = map[string]string{
+	"github.com/go-yaml/yaml.json":                      goYamlVuln,
+	"golang.org/x/crypto/ssh.json":                      cryptoSSHVuln,
+	"k8s.io/apiextensions-apiserver/pkg/apiserver.json": k8sAPIServerVuln,
+}
+
+// addToLocalDb adds vuln for package p to local db at path db.
+func addToLocalDb(db, p, vuln string) error {
+	if err := os.MkdirAll(path.Join(db, filepath.Dir(p)), fs.ModePerm); err != nil {
+		return err
+	}
+
+	f, err := os.Create(path.Join(db, p))
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	f.Write([]byte(vuln))
+	return nil
+}
+
+// addToServerDb adds vuln for package p to localhost server identified by its handler.
+func addToServerDb(handler *http.ServeMux, p, vuln string) {
+	handler.HandleFunc("/"+p, func(w http.ResponseWriter, req *http.Request) { fmt.Fprint(w, vuln) })
+}
+
+// envUpdate updates an environment e by setting the key to value.
+func envUpdate(e []string, key, value string) []string {
+	var nenv []string
+	for _, kv := range e {
+		if strings.HasPrefix(kv, key+"=") {
+			nenv = append(nenv, key+"="+value)
+		} else {
+			nenv = append(nenv, kv)
+		}
+	}
+	return nenv
+}
+
+// cmd type encapsulating a shell command and its context.
+type cmd struct {
+	dir  string
+	env  []string
+	name string
+	args []string
+}
+
+// execAll executes a sequence of commands cmd. Exits on a first
+// encountered error returning the error and the accumulated output.
+func execAll(cmds []cmd) ([]byte, error) {
+	var out []byte
+	for _, c := range cmds {
+		o, err := execCmd(c.dir, c.env, c.name, c.args...)
+		out = append(out, o...)
+		if err != nil {
+			return o, err
+		}
+	}
+	return out, nil
+}
+
+// execCmd runs the command name with arg in dir location with the env environment.
+func execCmd(dir string, env []string, name string, arg ...string) ([]byte, error) {
+	cmd := exec.Command(name, arg...)
+	cmd.Dir = dir
+	cmd.Env = env
+	return cmd.CombinedOutput()
+}
+
+// finding abstraction of Finding, for test purposes.
+type finding struct {
+	symbol   string
+	traceLen int
+}
+
+func testFindings(finds []audit.Finding) []finding {
+	var fs []finding
+	for _, f := range finds {
+		fs = append(fs, finding{symbol: f.Symbol, traceLen: len(f.Trace)})
+	}
+	return fs
+}
+
+func subset(finds1, finds2 []finding) bool {
+	fs2 := make(map[finding]bool)
+	for _, f := range finds2 {
+		fs2[f] = true
+	}
+
+	for _, f := range finds1 {
+		if !fs2[f] {
+			return false
+		}
+	}
+	return true
+}
+
+func TestHashicorpVault(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test in short mode.")
+	}
+	e := packagestest.Export(t, packagestest.Modules, []packagestest.Module{
+		{
+			Name: "foo",
+		},
+	})
+	defer e.Cleanup()
+
+	hashiVaultOkta := "github.com/hashicorp/vault/builtin/credential/okta"
+
+	// Go get hashicorp-vault okta package v1.6.3.
+	env := envUpdate(e.Config.Env, "GOPROXY", "https://proxy.golang.org,direct")
+	if out, err := execCmd(e.Config.Dir, env, "go", "get", hashiVaultOkta+"@v1.6.3"); err != nil {
+		t.Logf("failed to get %s: %s", hashiVaultOkta+"@v1.6.3", out)
+		t.Fatal(err)
+	}
+
+	// run goaudit.
+	cfg := &packages.Config{
+		Mode:  packages.LoadAllSyntax | packages.NeedModule,
+		Tests: false,
+		Dir:   e.Config.Dir,
+	}
+
+	// Create a local filesystem db.
+	dbPath := path.Join(e.Config.Dir, "db")
+	addToLocalDb(dbPath, "index.json", index)
+	// Create a local server db.
+	sMux := http.NewServeMux()
+	s := http.Server{Addr: ":8080", Handler: sMux}
+	go func() { s.ListenAndServe() }()
+	defer func() { s.Shutdown(context.Background()) }()
+	addToServerDb(sMux, "index.json", index)
+
+	for _, test := range []struct {
+		source string
+		// list of packages whose vulns should be addded to source
+		toAdd []string
+		want  []finding
+	}{
+		// test local db without yaml, which should result in no findings.
+		{source: "file://" + dbPath, want: nil,
+			toAdd: []string{"golang.org/x/crypto/ssh.json", "k8s.io/apiextensions-apiserver/pkg/apiserver.json"}},
+		// add yaml to the local db, which should produce 2 findings.
+		{source: "file://" + dbPath, toAdd: []string{"github.com/go-yaml/yaml.json"},
+			want: []finding{
+				{"github.com/go-yaml/yaml.decoder.unmarshal", 6},
+				{"github.com/go-yaml/yaml.yaml_parser_fetch_more_tokens", 12}},
+		},
+		// repeat the similar experiment with a server db.
+		{source: "http://localhost:8080", toAdd: []string{"k8s.io/apiextensions-apiserver/pkg/apiserver.json"}, want: nil},
+		{source: "http://localhost:8080", toAdd: []string{"golang.org/x/crypto/ssh.json", "github.com/go-yaml/yaml.json"},
+			want: []finding{
+				{"github.com/go-yaml/yaml.decoder.unmarshal", 6},
+				{"github.com/go-yaml/yaml.yaml_parser_fetch_more_tokens", 12}},
+		},
+	} {
+		for _, add := range test.toAdd {
+			if strings.HasPrefix(test.source, "file://") {
+				addToLocalDb(dbPath, add, vulns[add])
+			} else {
+				addToServerDb(sMux, add, vulns[add])
+			}
+		}
+
+		finds, err := run(cfg, []string{hashiVaultOkta}, false, []string{test.source})
+		if err != nil {
+			t.Fatal(err)
+		}
+		sort.SliceStable(finds, func(i int, j int) bool { return audit.FindingCompare(finds[i], finds[j]) })
+		if fs := testFindings(finds); !subset(test.want, fs) {
+			t.Errorf("want %v subset of findings; got %v", test.want, fs)
+		}
+	}
+}
+
+// isSecure checks if http resp was made over a secure connection.
+func isSecure(resp *http.Response) bool {
+	if resp.TLS == nil {
+		return false
+	}
+
+	// Check the final URL scheme too for good measure.
+	if resp.Request.URL.Scheme != "https" {
+		return false
+	}
+
+	return true
+}
+
+// download fetches the content at url and stores it at destination location.
+func download(url, destination string) error {
+	tr := &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: false},
+	}
+	client := &http.Client{Transport: tr}
+	resp, err := client.Get(url)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if !isSecure(resp) {
+		return fmt.Errorf("insecure connection to %s", url)
+	}
+
+	out, err := os.Create(destination)
+	if err != nil {
+		return err
+	}
+	defer out.Close()
+
+	_, err = io.Copy(out, resp.Body)
+	return err
+}
+
+// TestKubernetes requires the following system dependencies:
+//   - make, tar, unzip, and gcc.
+// More information on installing kubernetes: https://github.com/kubernetes/kubernetes.
+// Note that the whole installation will require roughly 5GB of disk.
+func TestKubernetes(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test in short mode.")
+	}
+	e := packagestest.Export(t, packagestest.Modules, []packagestest.Module{
+		{
+			Name: "foo",
+		},
+	})
+	defer e.Cleanup()
+
+	// Environments and directories to build and download both k8s and go.
+	env := envUpdate(e.Config.Env, "GOPROXY", "https://proxy.golang.org,direct")
+	dir := e.Config.Dir
+	k8sDir := path.Join(e.Config.Dir, "kubernetes-1.15.11")
+	k8sEnv := envUpdate(env, "PATH", path.Join(e.Config.Dir, "go/bin")+":"+os.Getenv("PATH"))
+
+	// Download kubernetes v1.15.11 and the go version 1.12 needed to build it.
+	if err := download("https://github.com/kubernetes/kubernetes/archive/v1.15.11.zip", path.Join(dir, "v1.15.11")); err != nil {
+		t.Fatal(err)
+	}
+	goZip := "go1.12.17." + runtime.GOOS + "-" + runtime.GOARCH + ".tar.gz"
+	if err := download("https://golang.org/dl/"+goZip, path.Join(dir, goZip)); err != nil {
+		t.Fatal(err)
+	}
+
+	// Unzip k8s and go, and then build the k8s.
+	if out, err := execAll([]cmd{
+		{dir, env, "unzip", []string{"v1.15.11"}},
+		{dir, env, "tar", []string{"-xf", goZip}},
+		{k8sDir, k8sEnv, "make", nil},
+	}); err != nil {
+		t.Logf("failed to build k8s: %s", out)
+		t.Fatal(err)
+	}
+
+	// Create a local filesystem db.
+	dbPath := path.Join(e.Config.Dir, "db")
+	addToLocalDb(dbPath, "index.json", index)
+	// Create a local server db.
+	sMux := http.NewServeMux()
+	s := http.Server{Addr: ":8080", Handler: sMux}
+	go func() { s.ListenAndServe() }()
+	defer func() { s.Shutdown(context.Background()) }()
+	addToServerDb(sMux, "index.json", index)
+
+	// run goaudit.
+	cfg := &packages.Config{
+		Mode:  packages.LoadAllSyntax | packages.NeedModule,
+		Tests: false,
+		Dir:   path.Join(e.Config.Dir, "kubernetes-1.15.11"),
+	}
+
+	for _, test := range []struct {
+		source string
+		// list of packages whose vulns should be addded to source
+		toAdd []string
+		want  []finding
+	}{
+		// test local db with only apiserver vuln, which should result in a single finding.
+		{source: "file://" + dbPath, toAdd: []string{"github.com/go-yaml/yaml.json", "k8s.io/apiextensions-apiserver/pkg/apiserver.json"},
+			want: []finding{{"k8s.io/apiextensions-apiserver/pkg/apiserver.NewCustomResourceDefinitionHandler", 3}}},
+		// add the rest of the vulnerabilites, resulting in more findings.
+		{source: "file://" + dbPath, toAdd: []string{"golang.org/x/crypto/ssh.json"},
+			want: []finding{
+				{"golang.org/x/crypto/ssh.NewPublicKey", 1},
+				{"k8s.io/apiextensions-apiserver/pkg/apiserver.NewCustomResourceDefinitionHandler", 3},
+				{"golang.org/x/crypto/ssh.NewPublicKey", 4},
+				{"golang.org/x/crypto/ssh.parseED25519", 9},
+			}},
+		// repeat similar experiment with a server db.
+		{source: "http://localhost:8080", toAdd: []string{"github.com/go-yaml/yaml.json"}, want: nil},
+		{source: "http://localhost:8080", toAdd: []string{"golang.org/x/crypto/ssh.json", "k8s.io/apiextensions-apiserver/pkg/apiserver.json"},
+			want: []finding{
+				{"golang.org/x/crypto/ssh.NewPublicKey", 1},
+				{"k8s.io/apiextensions-apiserver/pkg/apiserver.NewCustomResourceDefinitionHandler", 3},
+				{"golang.org/x/crypto/ssh.NewPublicKey", 4},
+				{"golang.org/x/crypto/ssh.parseED25519", 9},
+			}},
+	} {
+		for _, add := range test.toAdd {
+			if strings.HasPrefix(test.source, "file://") {
+				addToLocalDb(dbPath, add, vulns[add])
+			} else {
+				addToServerDb(sMux, add, vulns[add])
+			}
+		}
+
+		finds, err := run(cfg, []string{"./..."}, false, []string{test.source})
+		if err != nil {
+			t.Fatal(err)
+		}
+		sort.SliceStable(finds, func(i int, j int) bool { return audit.FindingCompare(finds[i], finds[j]) })
+		if fs := testFindings(finds); !subset(test.want, fs) {
+			t.Errorf("want %v subset of findings; got %v", test.want, fs)
+		}
+	}
+}
diff --git a/vulndb/internal/audit/detect.go b/vulndb/internal/audit/detect.go
new file mode 100644
index 0000000..1e93412
--- /dev/null
+++ b/vulndb/internal/audit/detect.go
@@ -0,0 +1,231 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package audit finds vulnerabilities affecting Go packages.
+package audit
+
+import (
+	"fmt"
+	"go/token"
+	"io"
+
+	"golang.org/x/vulndb/osv"
+)
+
+// Preamble with types and common functionality used by vulnerability detection mechanisms in detect_*.go files.
+
+// Finding represents a finding for the use of a vulnerable symbol or an imported vulnerable package.
+// Provides info on symbol location, trace leading up to the symbol use, and associated vulnerabilities.
+type Finding struct {
+	Symbol   string
+	Position *token.Position `json:",omitempty"`
+	Type     SymbolType
+	Vulns    []osv.Entry
+	Trace    []TraceElem
+
+	// Approximate measure for indicating how useful the finding might be to the audit client.
+	// The smaller the weight, the more useful is the finding.
+	weight int
+}
+
+// SymbolType represents a type of a symbol use: function, global, or an import statement.
+type SymbolType int
+
+// enum values for SymbolType.
+const (
+	FunctionType SymbolType = iota
+	ImportType
+	GlobalType
+)
+
+// TraceElem represents an entry in the finding trace. Represents a function call or an import statement.
+type TraceElem struct {
+	Description string
+	Position    *token.Position `json:",omitempty"`
+}
+
+// Env encapsulates information for querying if an imported symbol/package is vulnerable:
+//  - platform info
+//  - package versions
+//  - vulnerability db
+type Env struct {
+	OS          string
+	Arch        string
+	PkgVersions map[string]string
+	Vulns       []*osv.Entry
+}
+
+// Write method for findings showing the trace and the associated vulnerabilities.
+func (f Finding) Write(w io.Writer) {
+	var pos string
+	if f.Position != nil {
+		pos = fmt.Sprintf(" (%s)", f.Position)
+	}
+	fmt.Fprintf(w, "Trace:\n%s%s\n", f.Symbol, pos)
+	writeTrace(w, f.Trace)
+	io.WriteString(w, "\n")
+	writeVulns(w, f.Vulns)
+	io.WriteString(w, "\n")
+}
+
+// writeTrace in reverse order, e.g., entry point is written last.
+func writeTrace(w io.Writer, trace []TraceElem) {
+	for i := len(trace) - 1; i >= 0; i-- {
+		trace[i].Write(w)
+		io.WriteString(w, "\n")
+	}
+}
+
+func writeVulns(w io.Writer, vulns []osv.Entry) {
+	fmt.Fprintf(w, "Vulnerabilities:\n")
+	for _, v := range vulns {
+		fmt.Fprintf(w, "%s (%s)\n", v.Package.Name, v.EcosystemSpecific.URL)
+	}
+}
+
+func (e TraceElem) Write(w io.Writer) {
+	var pos string
+	if e.Position != nil {
+		pos = fmt.Sprintf(" (%s)", e.Position)
+	}
+	fmt.Fprintf(w, "%s%s", e.Description, pos)
+}
+
+// MarshalText implements the encoding.TextMarshaler interface.
+func (s SymbolType) MarshalText() ([]byte, error) {
+	var name string
+	switch s {
+	default:
+		name = "unrecognized"
+	case FunctionType:
+		name = "function"
+	case ImportType:
+		name = "import"
+	case GlobalType:
+		name = "global"
+	}
+	return []byte(name), nil
+}
+
+func matchingVulns(os, arch, version string, vulns []*osv.Entry) []*osv.Entry {
+	var matches []*osv.Entry
+	for _, vuln := range vulns {
+		if matchesPlatformAndVersion(os, arch, version, vuln) {
+			matches = append(matches, vuln)
+		}
+	}
+	return matches
+}
+
+// matchesPlatformAndVersion checks if `os`, `arch`, and `version` match the vulnerability `vuln`.
+func matchesPlatformAndVersion(os, arch, version string, vuln *osv.Entry) bool {
+	return matchesPlatform(os, vuln.EcosystemSpecific.GOOS) && matchesPlatform(arch, vuln.EcosystemSpecific.GOARCH) && vuln.Affects.AffectsSemver(version)
+}
+
+// matchesPlatform checks if `platform`, typically os or system architecture,
+// matches `platforms`. Empty `platforms` is also a match.
+func matchesPlatform(platform string, platforms []string) bool {
+	if len(platforms) == 0 {
+		return true
+	}
+
+	for _, p := range platforms {
+		if platform == p {
+			return true
+		}
+	}
+	return false
+}
+
+// pkgVulnerabilities map for fast lookup on vulnerable packages.
+// Maps package paths to their vulnerabilities.
+type pkgVulnerabilities map[string][]*osv.Entry
+
+// createPkgVulns creates a fast package-vulnerability look-up map for `vulns`.
+func createPkgVulns(vulns []*osv.Entry) pkgVulnerabilities {
+	pkgVulns := make(pkgVulnerabilities)
+	for _, vuln := range vulns {
+		pkgVulns[vuln.Package.Name] = append(pkgVulns[vuln.Package.Name], vuln)
+	}
+	return pkgVulns
+}
+
+// vulnerabilities returns a list of vulnerabilities that deem `pkgPath` vulnerable at `version` as well
+// as `arch` architecture and `os` operating system. Assumes version strings in `pkgVulns` are well-formed;
+// otherwise, the correctness of the results is not guaranteed.
+func (pkgVulns pkgVulnerabilities) vulnerabilities(pkgPath, version, arch, os string) []*osv.Entry {
+	vulns, ok := pkgVulns[pkgPath]
+	if !ok {
+		return nil
+	}
+	return matchingVulns(os, arch, version, vulns)
+}
+
+func queryPkgVulns(pkgPath string, env Env, pkgVulns pkgVulnerabilities) []*osv.Entry {
+	version, ok := env.PkgVersions[pkgPath]
+	if !ok {
+		return nil
+	}
+	return pkgVulns.vulnerabilities(pkgPath, version, env.Arch, env.OS)
+}
+
+// symVulnerabilities map for fast lookup on vulnerable symbols.
+// Maps package paths to symbols to their vulnerabilities.
+type symVulnerabilities map[string]map[string][]*osv.Entry
+
+// Represents any symbol. Used to model vulnerabilities in
+// symVulnerabilties that define every symbol as vulnerable.
+const symWildCard = "*"
+
+// createSymVulns creates a fast symbol-vulnerability look-up map for `vulns`.
+func createSymVulns(vulns []*osv.Entry) symVulnerabilities {
+	symVulns := make(symVulnerabilities)
+	for _, vuln := range vulns {
+		if len(vuln.EcosystemSpecific.Symbols) == 0 {
+			// If vuln.Symbols is empty, every symbol is vulnerable.
+			symVulns.add(symWildCard, vuln)
+		} else {
+			for _, sym := range vuln.EcosystemSpecific.Symbols {
+				symVulns.add(sym, vuln)
+			}
+		}
+	}
+	return symVulns
+}
+
+func (symVulns symVulnerabilities) add(symbol string, v *osv.Entry) {
+	syms := symVulns[v.Package.Name]
+	if syms == nil {
+		syms = make(map[string][]*osv.Entry)
+		symVulns[v.Package.Name] = syms
+	}
+	syms[symbol] = append(syms[symbol], v)
+}
+
+// vulnerabilities returns a list of vulnerabilities that deem `symbol` from package `pkgPath` vulnerable at
+// `version`, architecture `arch`, and operating system `os`. Assumes version strings in `symVulns` are well-formed;
+// otherwise, the correctness of the results is not guaranteed.
+func (symVulns symVulnerabilities) vulnerabilities(symbol, pkgPath, version, arch, os string) []*osv.Entry {
+	pkgVulns, ok := symVulns[pkgPath]
+	if !ok {
+		return nil
+	}
+
+	var vulns []*osv.Entry
+	vulns = append(vulns, pkgVulns[symbol]...)
+	vulns = append(vulns, pkgVulns[symWildCard]...)
+	if len(vulns) == 0 {
+		return nil
+	}
+
+	return matchingVulns(os, arch, version, vulns)
+}
+
+func querySymbolVulns(symbol, pkgPath string, symVulns symVulnerabilities, env Env) []*osv.Entry {
+	version, ok := env.PkgVersions[pkgPath]
+	if !ok {
+		return nil
+	}
+	return symVulns.vulnerabilities(symbol, pkgPath, version, env.Arch, env.OS)
+}
diff --git a/vulndb/internal/audit/detect_binary.go b/vulndb/internal/audit/detect_binary.go
new file mode 100644
index 0000000..b5dd324
--- /dev/null
+++ b/vulndb/internal/audit/detect_binary.go
@@ -0,0 +1,33 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package audit
+
+import (
+	"fmt"
+)
+
+// VulnerablePackageSymbols returns a list of vulnerability findings for per-package symbols
+// in packageSymbols, given the vulnerability and platform info captured in env.
+//
+// Returned Findings only have Symbol, Type, and Vulns fields set.
+func VulnerablePackageSymbols(packageSymbols map[string][]string, env Env) []Finding {
+	symVulns := createSymVulns(env.Vulns)
+
+	var findings []Finding
+	for pkg, symbols := range packageSymbols {
+		for _, symbol := range symbols {
+			if vulns := querySymbolVulns(symbol, pkg, symVulns, env); len(vulns) > 0 {
+				findings = append(findings,
+					Finding{
+						Symbol: fmt.Sprintf("%s.%s", pkg, symbol),
+						Type:   GlobalType,
+						Vulns:  serialize(vulns),
+					})
+			}
+		}
+	}
+
+	return findings
+}
diff --git a/vulndb/internal/audit/detect_callgraph.go b/vulndb/internal/audit/detect_callgraph.go
new file mode 100644
index 0000000..5adb8f5
--- /dev/null
+++ b/vulndb/internal/audit/detect_callgraph.go
@@ -0,0 +1,296 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package audit
+
+import (
+	"container/list"
+	"fmt"
+	"go/token"
+	"strings"
+
+	"golang.org/x/tools/go/callgraph"
+	"golang.org/x/tools/go/ssa"
+	"golang.org/x/tools/go/ssa/ssautil"
+
+	"golang.org/x/tools/go/callgraph/cha"
+	"golang.org/x/tools/go/callgraph/vta"
+)
+
+// VulnerableSymbols returns a list of vulnerability findings for symbols transitively reachable
+// through the callgraph built using VTA analysis from the entry points of pkgs, given the
+// vulnerability and platform info captured in env.
+//
+// Returns all findings reachable from pkgs while analyzing each package only once, prefering findings
+// of shorter import traces. For instance, given call chains
+//   A() -> B() -> V
+//   A() -> D() -> B() -> V
+//   D() -> B() -> V
+// where A and D are top level packages and V is a vulnerable symbol, VulnerableSymbols can return either
+//   A() -> B() -> V
+// or
+//   D() -> B() -> V
+// as traces of transitively using a vulnerable symbol V.
+//
+// Panics if packages in pkgs do not belong to the same program.
+func VulnerableSymbols(pkgs []*ssa.Package, env Env) []Finding {
+	prog := pkgsProgram(pkgs)
+	if prog == nil {
+		panic("packages in pkgs must belong to a single common program")
+	}
+	entries := entryPoints(pkgs)
+	callGraph := callGraph(prog, entries)
+
+	queue := list.New()
+	for _, entry := range entries {
+		queue.PushBack(&callChain{f: entry})
+	}
+
+	symVulns := createSymVulns(env.Vulns)
+	var findings []Finding
+	seen := make(map[*ssa.Function]bool)
+	for queue.Len() > 0 {
+		front := queue.Front()
+		v := front.Value.(*callChain)
+		queue.Remove(front)
+
+		if seen[v.f] {
+			continue
+		}
+		seen[v.f] = true
+
+		finds, calls := funcVulnsAndCalls(v, symVulns, env, callGraph)
+		findings = append(findings, finds...)
+		for _, call := range calls {
+			queue.PushBack(call)
+		}
+	}
+
+	return findings
+}
+
+// callGraph builds a call graph of prog based on VTA analysis.
+func callGraph(prog *ssa.Program, entries []*ssa.Function) *callgraph.Graph {
+	entrySlice := make(map[*ssa.Function]bool)
+	for _, e := range entries {
+		entrySlice[e] = true
+	}
+	initial := cha.CallGraph(prog)
+	allFuncs := ssautil.AllFunctions(prog)
+
+	fslice := forwardReachableFrom(entrySlice, initial)
+	// Keep only actually linked functions.
+	pruneSlice(fslice, allFuncs)
+	vtaCg := vta.CallGraph(fslice, initial)
+
+	// Repeat the process once more, this time using
+	// the produced VTA call graph as the base graph.
+	fslice = forwardReachableFrom(entrySlice, vtaCg)
+	pruneSlice(fslice, allFuncs)
+
+	return vta.CallGraph(fslice, vtaCg)
+}
+
+func entryPoints(topPackages []*ssa.Package) []*ssa.Function {
+	var entries []*ssa.Function
+	for _, pkg := range topPackages {
+		if pkg.Pkg.Name() == "main" {
+			// for "main" packages the only valid entry points are the "main"
+			// function and any "init#" functions, even if there are other
+			// exported functions or types. similarly to isEntry it should be
+			// safe to ignore the validity of the main or init# signatures,
+			// since the compiler will reject malformed definitions,
+			// and the init function is synthetic
+			entries = append(entries, memberFuncs(pkg.Members["main"], pkg.Prog)...)
+			for name, member := range pkg.Members {
+				if strings.HasPrefix(name, "init#") || name == "init" {
+					entries = append(entries, memberFuncs(member, pkg.Prog)...)
+				}
+			}
+			continue
+		}
+		for _, member := range pkg.Members {
+			for _, f := range memberFuncs(member, pkg.Prog) {
+				if isEntry(f) {
+					entries = append(entries, f)
+				}
+			}
+		}
+	}
+	return entries
+}
+
+func isEntry(f *ssa.Function) bool {
+	// it should be safe to ignore checking that the signature of the "init" function
+	// is valid, since it is synthetic
+	if f.Name() == "init" && f.Synthetic == "package initializer" {
+		return true
+	}
+
+	return f.Synthetic == "" && f.Object() != nil && f.Object().Exported()
+}
+
+// callChain helps doing BFS over package call graph while remembering the call stack.
+type callChain struct {
+	// nil for entry points of the chain.
+	call   ssa.CallInstruction
+	f      *ssa.Function
+	parent *callChain
+}
+
+func (chain *callChain) trace() []TraceElem {
+	if chain == nil {
+		return nil
+	}
+
+	var pos *token.Position
+	desc := fmt.Sprintf("%s.%s(...)", pkgPath(chain.f), chain.f.Name())
+	if chain.call != nil {
+		pos = instrPosition(chain.call)
+		if unresolved(chain.call) {
+			// In case of a statically unresolved call site, communicate to the client
+			// that this was approximatelly resolved to chain.f.
+			desc = fmt.Sprintf("%s(...) [approx. resolved to %s]", callName(chain.call), chain.f)
+		}
+	} else {
+		// No call information means the function is an entry point.
+		pos = funcPosition(chain.f)
+	}
+
+	return append(chain.parent.trace(), TraceElem{Description: desc, Position: pos})
+}
+
+// weight computes an approximate measure of how useful the call chain would
+// be to the client as a trace. The smaller the value, the more useful the chain.
+// Currently defined as the number of unresolved call sites in the chain.
+func (chain *callChain) weight() int {
+	if chain == nil {
+		return 0
+	}
+
+	callWeight := 0
+	if unresolved(chain.call) {
+		callWeight = 1
+	}
+	return callWeight + chain.parent.weight()
+}
+
+// funcVulnsAndCalls returns a list of symbol findings for function at the top
+// of chain and next calls to analyze.
+func funcVulnsAndCalls(chain *callChain, symVulns symVulnerabilities, env Env, callGraph *callgraph.Graph) ([]Finding, []*callChain) {
+	var findings []Finding
+	var calls []*callChain
+	for _, b := range chain.f.Blocks {
+		for _, instr := range b.Instrs {
+			// First collect all findings for globals except callees in function call statements.
+			findings = append(findings, globalFindings(globalUses(instr), chain, symVulns, env)...)
+
+			// Callees are handled separately to produce call findings rather than global findings.
+			site, ok := instr.(ssa.CallInstruction)
+			if !ok {
+				continue
+			}
+
+			callees := siteCallees(site, callGraph)
+			for _, callee := range callees {
+				c := &callChain{call: site, f: callee, parent: chain}
+				calls = append(calls, c)
+
+				if f := callFinding(c, symVulns, env); f != nil {
+					findings = append(findings, *f)
+				}
+			}
+		}
+	}
+	return findings, calls
+}
+
+// globalFindings returns findings for vulnerable globals among globalUses.
+// Assumes each use in globalUses is a use of a global variable. Can generate
+// duplicates when globalUses contains duplicates.
+func globalFindings(globalUses []*ssa.Value, chain *callChain, symVulns symVulnerabilities, env Env) []Finding {
+	if underRelatedVuln(chain, symVulns, env) {
+		return nil
+	}
+
+	var findings []Finding
+	for _, o := range globalUses {
+		g := (*o).(*ssa.Global)
+		vulns := querySymbolVulns(g.Name(), g.Package().Pkg.Path(), symVulns, env)
+		if len(vulns) > 0 {
+			findings = append(findings,
+				Finding{
+					Symbol:   fmt.Sprintf("%s.%s", g.Package().Pkg.Path(), g.Name()),
+					Trace:    chain.trace(),
+					Position: valPosition(*o, chain.f),
+					Type:     GlobalType,
+					Vulns:    serialize(vulns),
+					weight:   chain.weight()})
+		}
+	}
+	return findings
+}
+
+// callFinding returns vulnerability finding for the call made at the top of the chain.
+// If there is no vulnerability or no call information, then nil is returned.
+// TODO(zpavlinovic): remove ssa info from higher-order calls.
+func callFinding(chain *callChain, symVulns symVulnerabilities, env Env) *Finding {
+	if underRelatedVuln(chain, symVulns, env) {
+		return nil
+	}
+
+	callee := chain.f
+	call := chain.call
+	if callee == nil || call == nil {
+		return nil
+	}
+
+	vulns := querySymbolVulns(dbFuncName(callee), callee.Package().Pkg.Path(), symVulns, env)
+	if len(vulns) > 0 {
+		c := chain
+		if !unresolved(call) {
+			// If the last call is a resolved callsite, remove the edge from the trace as that
+			// information is provided in the symbol field.
+			c = c.parent
+		}
+		return &Finding{
+			Symbol:   fmt.Sprintf("%s.%s", callee.Package().Pkg.Path(), dbFuncName(callee)),
+			Trace:    c.trace(),
+			Position: instrPosition(call),
+			Type:     FunctionType,
+			Vulns:    serialize(vulns),
+			weight:   c.weight()}
+	}
+
+	return nil
+}
+
+// Checks if a potential vulnerability in chain.f is analyzed only because
+// a previous vulnerability in the same package as chain.f has been seen.
+// For instance, for the chain P1:A -> P2:B -> P2:C where both B and C are
+// vulnerable, the function returns true since B is already vulnerable and
+// has hence been reported. Clients are likely not interested in vulnerabilties
+// inside of a function that is already deemed vulnerable. This is an optimization
+// step to stop flooding of findings when a package has a lot of known vulnerable
+// symbols (e.g., all of them).
+//
+// Note that for P1:A -> P2:B -> P3:D -> P2:C the function returns false. This
+// is because C is called from D that comes from a different package.
+func underRelatedVuln(chain *callChain, symVulns symVulnerabilities, env Env) bool {
+	pkg := pkgPath(chain.f)
+
+	c := chain
+	for {
+		c = c.parent
+		// Analyze the immediate substack related to pkg.
+		if c == nil || pkgPath(c.f) != pkg {
+			break
+		}
+		// TODO: can we optimize using the information on findings already reported?
+		if len(querySymbolVulns(dbFuncName(c.f), c.f.Pkg.Pkg.Path(), symVulns, env)) > 0 {
+			return true
+		}
+	}
+	return false
+}
diff --git a/vulndb/internal/audit/detect_callgraph_test.go b/vulndb/internal/audit/detect_callgraph_test.go
new file mode 100644
index 0000000..a2723f7
--- /dev/null
+++ b/vulndb/internal/audit/detect_callgraph_test.go
@@ -0,0 +1,80 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package audit
+
+import (
+	"go/token"
+	"reflect"
+	"sort"
+	"testing"
+
+	"golang.org/x/vulndb/osv"
+)
+
+func TestSymbolVulnDetectionVTA(t *testing.T) {
+	pkgs, env := testProgAndEnv(t)
+	got := projectFindings(VulnerableSymbols(pkgs, env))
+
+	// There should be four call chains reported with VTA-VTA version, in the following order:
+	//   T:T1() -> vuln.VG                                     [use of global at line 4]
+	//   T:T1() -> A:A1() -> vuln.VulnData.Vuln()              [call at A.go:14]
+	//   T:T2() -> vuln.Vuln() [approx.resolved] -> vuln.VG    [use of global at vuln.go:4]
+	//   T:T1() -> vuln.VulnData.Vuln() [approx. resolved]     [call at testdata.go:13]
+	// Without VTA-VTA, we would alse have the following false positive:
+	//   T:T2() -> vuln.VulnData.Vuln() [approx. resolved]     [call at testdata.go:26]
+	want := []Finding{
+		{
+			Symbol: "thirdparty.org/vulnerabilities/vuln.VG",
+			Trace: []TraceElem{
+				{Description: "command-line-arguments.T1(...)", Position: &token.Position{Line: 11, Filename: "T.go"}},
+			},
+			Type:     GlobalType,
+			Position: &token.Position{Line: 5, Filename: "vuln.go"},
+			Vulns:    []osv.Entry{{Package: osv.Package{Name: "thirdparty.org/vulnerabilities/vuln"}}},
+			weight:   0,
+		},
+		{
+			Symbol: "thirdparty.org/vulnerabilities/vuln.VulnData.Vuln",
+			Trace: []TraceElem{
+				{Description: "command-line-arguments.T1(...)", Position: &token.Position{Line: 11, Filename: "T.go"}},
+				{Description: "a.org/A.A1(...)", Position: &token.Position{Line: 14, Filename: "T.go"}}},
+			Type:     FunctionType,
+			Position: &token.Position{Line: 15, Filename: "A.go"},
+			Vulns:    []osv.Entry{{Package: osv.Package{Name: "thirdparty.org/vulnerabilities/vuln"}}},
+			weight:   0,
+		},
+		{
+			Symbol: "thirdparty.org/vulnerabilities/vuln.VG",
+			Trace: []TraceElem{
+				{Description: "command-line-arguments.T2(...)", Position: &token.Position{Line: 20, Filename: "T.go"}},
+				{Description: "command-line-arguments.t0(...) [approx. resolved to thirdparty.org/vulnerabilities/vuln.Vuln]", Position: &token.Position{Line: 22, Filename: "T.go"}},
+			},
+			Type:     GlobalType,
+			Position: &token.Position{Line: 5, Filename: "vuln.go"},
+			Vulns:    []osv.Entry{{Package: osv.Package{Name: "thirdparty.org/vulnerabilities/vuln"}}},
+			weight:   1,
+		},
+		{
+			Symbol: "thirdparty.org/vulnerabilities/vuln.VulnData.Vuln",
+			Trace: []TraceElem{
+				{Description: "command-line-arguments.T1(...)", Position: &token.Position{Line: 11, Filename: "T.go"}},
+				{Description: "a.org/A.I.Vuln(...) [approx. resolved to (thirdparty.org/vulnerabilities/vuln.VulnData).Vuln]", Position: &token.Position{Line: 14, Filename: "T.go"}}},
+			Type:     FunctionType,
+			Position: &token.Position{Line: 14, Filename: "T.go"},
+			Vulns:    []osv.Entry{{Package: osv.Package{Name: "thirdparty.org/vulnerabilities/vuln"}}},
+			weight:   1,
+		},
+	}
+
+	if len(want) != len(got) {
+		t.Errorf("want %d findings; got %d", len(want), len(got))
+		return
+	}
+
+	sort.SliceStable(got, func(i int, j int) bool { return FindingCompare(got[i], got[j]) })
+	if !reflect.DeepEqual(want, got) {
+		t.Errorf("want %v findings (projected); got %v", want, got)
+	}
+}
diff --git a/vulndb/internal/audit/detect_imports.go b/vulndb/internal/audit/detect_imports.go
new file mode 100644
index 0000000..40a1b1f
--- /dev/null
+++ b/vulndb/internal/audit/detect_imports.go
@@ -0,0 +1,81 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package audit
+
+import (
+	"container/list"
+	"go/types"
+
+	"golang.org/x/tools/go/ssa"
+)
+
+// VulnerableImports returns a list of vulnerability findings for packages imported by `pkgs`
+// given the vulnerability and platform info captured in `env`.
+//
+// Returns all findings reachable from `pkgs` while analyzing each package only once, prefering
+// findings of shorter import traces. For instance, given import chains
+//   A -> B -> V
+//   A -> D -> B -> V
+//   D -> B -> V
+// where A and D are top level packages and V is a vulnerable package, VulnerableImports can return either
+//   A -> B -> V
+// or
+//   D -> B -> V
+// as traces of importing a vulnerable package V.
+func VulnerableImports(pkgs []*ssa.Package, env Env) []Finding {
+	pkgVulns := createPkgVulns(env.Vulns)
+
+	var findings []Finding
+	seen := make(map[string]bool)
+	queue := list.New()
+	for _, pkg := range pkgs {
+		queue.PushBack(&importChain{pkg: pkg.Pkg})
+	}
+
+	for queue.Len() > 0 {
+		front := queue.Front()
+		v := front.Value.(*importChain)
+		queue.Remove(front)
+
+		pkg := v.pkg
+		if pkg == nil {
+			continue
+		}
+
+		if seen[pkg.Path()] {
+			continue
+		}
+		seen[pkg.Path()] = true
+
+		for _, imp := range pkg.Imports() {
+			vulns := queryPkgVulns(imp.Path(), env, pkgVulns)
+			if len(vulns) > 0 {
+				findings = append(findings,
+					Finding{
+						Symbol: imp.Path(),
+						Type:   ImportType,
+						Trace:  v.trace(),
+						Vulns:  serialize(vulns),
+						weight: len(v.trace())})
+			}
+			queue.PushBack(&importChain{pkg: imp, parent: v})
+		}
+	}
+
+	return findings
+}
+
+// importChain helps doing BFS over package imports while remembering import chains.
+type importChain struct {
+	pkg    *types.Package
+	parent *importChain
+}
+
+func (chain *importChain) trace() []TraceElem {
+	if chain == nil {
+		return nil
+	}
+	return append(chain.parent.trace(), TraceElem{Description: chain.pkg.Path()})
+}
diff --git a/vulndb/internal/audit/detect_imports_test.go b/vulndb/internal/audit/detect_imports_test.go
new file mode 100644
index 0000000..0e36097
--- /dev/null
+++ b/vulndb/internal/audit/detect_imports_test.go
@@ -0,0 +1,52 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package audit
+
+import (
+	"reflect"
+	"sort"
+	"testing"
+
+	"golang.org/x/vulndb/osv"
+)
+
+func TestImportedPackageVulnDetection(t *testing.T) {
+	pkgs, env := testProgAndEnv(t)
+	got := projectFindings(VulnerableImports(pkgs, env))
+
+	// There should be two chains reported in the following order:
+	//   T -> vuln
+	//   T -> A -> vuln
+	want := []Finding{
+		{
+			Symbol: "thirdparty.org/vulnerabilities/vuln",
+			Trace:  []TraceElem{{Description: "command-line-arguments"}},
+			Type:   ImportType,
+			Vulns: []osv.Entry{
+				{Package: osv.Package{Name: "thirdparty.org/vulnerabilities/vuln"}},
+				{Package: osv.Package{Name: "thirdparty.org/vulnerabilities/vuln"}}},
+			weight: 1,
+		},
+		{
+			Symbol: "thirdparty.org/vulnerabilities/vuln",
+			Trace:  []TraceElem{{Description: "command-line-arguments"}, {Description: "a.org/A"}},
+			Type:   ImportType,
+			Vulns: []osv.Entry{
+				{Package: osv.Package{Name: "thirdparty.org/vulnerabilities/vuln"}},
+				{Package: osv.Package{Name: "thirdparty.org/vulnerabilities/vuln"}}},
+			weight: 2,
+		},
+	}
+
+	if len(want) != len(got) {
+		t.Errorf("want %d findings; got %d", len(want), len(got))
+		return
+	}
+
+	sort.SliceStable(got, func(i int, j int) bool { return FindingCompare(got[i], got[j]) })
+	if !reflect.DeepEqual(want, got) {
+		t.Errorf("want %v findings (projected); got %v", want, got)
+	}
+}
diff --git a/vulndb/internal/audit/detect_test.go b/vulndb/internal/audit/detect_test.go
new file mode 100644
index 0000000..a90c7e3
--- /dev/null
+++ b/vulndb/internal/audit/detect_test.go
@@ -0,0 +1,122 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package audit
+
+import (
+	"testing"
+
+	"golang.org/x/vulndb/osv"
+)
+
+var testVulnerabilities = []*osv.Entry{
+	{
+		Package: osv.Package{
+			Name: "xyz.org/vuln",
+		},
+		Affects: osv.Affects{
+			Ranges: []osv.AffectsRange{
+				{
+					Type:       osv.TypeSemver,
+					Introduced: "v1.0.1",
+					Fixed:      "v3.2.6",
+				},
+			},
+		},
+		EcosystemSpecific: osv.GoSpecific{
+			Symbols: []string{"foo", "bar"},
+			GOOS:    []string{"amd64"},
+			GOARCH:  []string{"linux"},
+		},
+	},
+	{
+		Package: osv.Package{
+			Name: "xyz.org/vuln",
+		},
+		Affects: osv.Affects{
+			Ranges: []osv.AffectsRange{
+				{
+					Type:  osv.TypeSemver,
+					Fixed: "v4.0.0",
+				},
+			},
+		},
+		EcosystemSpecific: osv.GoSpecific{
+			Symbols: []string{"foo"},
+		},
+	},
+	{
+		Package: osv.Package{
+			Name: "abc.org/morevuln",
+		},
+	},
+}
+
+func TestPackageVulnCreationAndChecking(t *testing.T) {
+	pkgVulns := createPkgVulns(testVulnerabilities)
+	if len(pkgVulns) != 2 {
+		t.Errorf("want 2 package paths; got %d", len(pkgVulns))
+	}
+
+	for _, test := range []struct {
+		path    string
+		version string
+		os      string
+		arch    string
+		noVulns int
+	}{
+		// xyz.org/vuln has foo and bar vulns for linux, and just foo for windows.
+		{"xyz.org/vuln", "v1.0.1", "amd64", "linux", 2},
+		{"xyz.org/vuln", "v1.0.1", "amd64", "windows", 1},
+		{"xyz.org/vuln", "v2.4.5", "amd64", "linux", 2},
+		{"xyz.org/vuln", "v3.2.7", "amd64", "linux", 1},
+		// foo for linux must be at version before v4.0.0.
+		{"xyz.org/vuln", "v5.4.5", "amd64", "linux", 0},
+		// abc.org/morevuln has vulnerabilities for any symbol, platform, and version
+		{"abc.org/morevuln", "v11.0.1", "amd64", "linux", 1},
+		{"abc.org/morevuln", "v300.0.1", "i386", "windows", 1},
+	} {
+		if vulns := pkgVulns.vulnerabilities(test.path, test.version, test.arch, test.os); len(vulns) != test.noVulns {
+			t.Errorf("want %d vulnerabilities for %s (v:%s, o:%s, a:%s); got %d",
+				test.noVulns, test.path, test.version, test.os, test.path, len(vulns))
+		}
+	}
+}
+
+func TestSymbolVulnCreationAndChecking(t *testing.T) {
+	symVulns := createSymVulns(testVulnerabilities)
+	if len(symVulns) != 2 {
+		t.Errorf("want 2 package paths; got %d", len(symVulns))
+	}
+
+	for _, test := range []struct {
+		symbol   string
+		path     string
+		version  string
+		os       string
+		arch     string
+		numVulns int
+	}{
+		// foo appears twice as a vulnerable symbol for "xyz.org/vuln" and bar once.
+		{"foo", "xyz.org/vuln", "v1.0.1", "amd64", "linux", 2},
+		{"bar", "xyz.org/vuln", "v1.0.1", "amd64", "linux", 1},
+		// foo and bar detected vulns should go down by one for windows platform as well as i386 architecture.
+		{"foo", "xyz.org/vuln", "v1.0.1", "amd64", "windows", 1},
+		{"bar", "xyz.org/vuln", "v1.0.1", "i386", "linux", 0},
+		// There should be no findings for foo and bar at module version v5.0.0.
+		{"foo", "xyz.org/vuln", "v5.0.0", "amd64", "linux", 0},
+		{"bar", "xyz.org/vuln", "v5.0.0", "amd64", "linux", 0},
+		// symbol is not a vulnerable symbol for xyz.org/vuln and bogus package is not in the database.
+		{"symbol", "xyz.org/vuln", "v1.0.1", "amd64", "linux", 0},
+		{"foo", "bogus", "v1.0.1", "amd64", "linux", 0},
+		// abc.org/morevuln has vulnerabilities for any symbol, platform, and version
+		{"symbol", "abc.org/morevuln", "v2.0.1", "amd64", "linux", 1},
+		{"lobmys", "abc.org/morevuln", "v300.0.1", "i386", "windows", 1},
+	} {
+		if vulns := symVulns.vulnerabilities(test.symbol, test.path, test.version, test.arch, test.os); len(vulns) != test.numVulns {
+			t.Errorf("want %d vulnerabilities for %s (p:%s v:%s, o:%s, a:%s); got %d",
+				test.numVulns, test.symbol, test.path, test.version, test.os, test.arch, len(vulns))
+		}
+	}
+}
diff --git a/vulndb/internal/audit/helpers_test.go b/vulndb/internal/audit/helpers_test.go
new file mode 100644
index 0000000..f00cd7e
--- /dev/null
+++ b/vulndb/internal/audit/helpers_test.go
@@ -0,0 +1,165 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package audit
+
+import (
+	"go/token"
+	"io/ioutil"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"golang.org/x/tools/go/packages"
+	"golang.org/x/tools/go/packages/packagestest"
+	"golang.org/x/tools/go/ssa"
+	"golang.org/x/tools/go/ssa/ssautil"
+	"golang.org/x/vulndb/osv"
+)
+
+// Loads test program and environment with the following import structure
+//                 T
+//              /  |  \
+//             A   |   B
+//             \   |   /
+//              \  |  A
+//               \ | /
+//               vuln
+// where `vuln` is a package containing some vulnerabilities. The definition
+// of T can be found in testdata/top_package.go, A is in testdata/a_dep.go,
+// B is in testdata/b_dep.go, and vuln is in testdata/vuln.go.
+//
+// The program has the following vulnerabilities that should be reported
+//   T:T1() -> vuln.VG
+//   T:T1() -> A:A1() -> vuln.VulnData.Vuln()
+//   T:T2() -> vuln.Vuln() [approx.resolved] -> vuln.VG
+//   T:T1() -> vuln.VulnData.Vuln() [approx. resolved]
+//
+// The following vulnerability should not be reported as it is redundant:
+//   T:T1() -> A:A1() -> B:B1() -> vuln.VulnData.Vuln()
+//
+// The produced environment is based on testdata/dbs vulnerability databases.
+func testProgAndEnv(t *testing.T) ([]*ssa.Package, Env) {
+	e := packagestest.Export(t, packagestest.Modules, []packagestest.Module{
+		{
+			Name:  "golang.org/vulntest",
+			Files: map[string]interface{}{"T/T.go": readFile(t, "testdata/top_package.go")},
+		},
+		{
+			Name:  "a.org@v1.1.1",
+			Files: map[string]interface{}{"A/A.go": readFile(t, "testdata/a_dep.go")},
+		},
+		{
+			Name:  "b.org@v1.2.2",
+			Files: map[string]interface{}{"B/B.go": readFile(t, "testdata/b_dep.go")},
+		},
+		{
+			Name:  "thirdparty.org/vulnerabilities@v1.0.1",
+			Files: map[string]interface{}{"vuln/vuln.go": readFile(t, "testdata/vuln.go")},
+		},
+	})
+	defer e.Cleanup()
+
+	_, ssaPkgs, pkgs, err := loadAndBuildPackages(e, "/vulntest/T/T.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(ssaPkgs) != 1 {
+		t.Errorf("want 1 top level SSA package; got %d", len(ssaPkgs))
+	}
+
+	vulnsToLoad := []string{"thirdparty.org/vulnerabilities", "bogus.org/module"}
+	dbSources := []string{fileSource(t, "testdata/dbs/bogus.db.org"), fileSource(t, "testdata/dbs/golang.deepgo.org")}
+	vulns, err := LoadVulnerabilities(dbSources, vulnsToLoad)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return ssaPkgs, Env{OS: "linux", Arch: "amd64", Vulns: vulns, PkgVersions: PackageVersions(pkgs)}
+}
+
+func loadAndBuildPackages(e *packagestest.Exported, file string) (*ssa.Program, []*ssa.Package, []*packages.Package, error) {
+	e.Config.Mode |= packages.NeedModule | packages.LoadAllSyntax
+	// Get the path to the test file.
+	filepath := path.Join(e.Temp(), file)
+	pkgs, err := packages.Load(e.Config, filepath)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	prog, ssaPkgs := ssautil.AllPackages(pkgs, 0)
+	prog.Build()
+	return prog, ssaPkgs, pkgs, nil
+}
+
+// projectPosition simplifies position to only filename and location info.
+func projectPosition(pos *token.Position) *token.Position {
+	if pos == nil {
+		return nil
+	}
+	fname := pos.Filename
+	if fname != "" {
+		fname = filepath.Base(fname)
+	}
+	return &token.Position{Line: pos.Line, Filename: fname}
+}
+
+// projectTrace simplifies traces for testing comparison purposes
+// by simplifying position info.
+func projectTrace(trace []TraceElem) []TraceElem {
+	var nt []TraceElem
+	for _, e := range trace {
+		nt = append(nt, TraceElem{Description: e.Description, Position: projectPosition(e.Position)})
+	}
+	return nt
+}
+
+// projectVulns simplifies vulnerabilities for testing comparison purposes
+// to only package path.
+func projectVulns(vulns []osv.Entry) []osv.Entry {
+	var nv []osv.Entry
+	for _, v := range vulns {
+		nv = append(nv, osv.Entry{Package: osv.Package{Name: v.Package.Name}})
+	}
+	return nv
+}
+
+// projectFindings simplifies findings for testing comparison purposes. Traces
+// are removed their position info, finding's position only contains file and
+// line info, and vulnerabilities only have package path.
+func projectFindings(findings []Finding) []Finding {
+	var nfs []Finding
+	for _, f := range findings {
+		nf := Finding{
+			Type:     f.Type,
+			Symbol:   f.Symbol,
+			Position: projectPosition(f.Position),
+			Trace:    projectTrace(f.Trace),
+			Vulns:    projectVulns(f.Vulns),
+			weight:   f.weight,
+		}
+		nfs = append(nfs, nf)
+	}
+	return nfs
+}
+
+// fileSource creates a file URI for a database path `db`. If `db` is
+// relative, the source is made absolute w.r.t. the current directory.
+func fileSource(t *testing.T, db string) string {
+	cd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return "file://" + path.Join(cd, db)
+}
+
+func readFile(t *testing.T, path string) string {
+	content, err := ioutil.ReadFile(path)
+	if err != nil {
+		t.Fatalf("failed to load code from `%v`: %v", path, err)
+	}
+	return strings.ReplaceAll(string(content), "// go:build ignore", "")
+}
diff --git a/vulndb/internal/audit/order.go b/vulndb/internal/audit/order.go
new file mode 100644
index 0000000..0f595f7
--- /dev/null
+++ b/vulndb/internal/audit/order.go
@@ -0,0 +1,66 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package audit
+
+import (
+	"fmt"
+	"strings"
+)
+
+// FindingCompare compares two findings in terms of their approximate usefulness to the user.
+// A finding that either has 1) shorter trace, or 2) less unresolved call sites in the trace
+// is considered smaller, i.e., better.
+func FindingCompare(finding1, finding2 Finding) bool {
+	if len(finding1.Trace) < len(finding2.Trace) {
+		return true
+	} else if len(finding2.Trace) < len(finding1.Trace) {
+		return false
+	}
+	if finding1.weight < finding2.weight {
+		return true
+	} else if finding2.weight < finding1.weight {
+		return false
+	}
+	// At this point we just need to make sure the ordering is deterministic.
+	// TODO(zpavlinovic): is there a more meaningful ordering?
+	return findingStrCompare(finding1, finding2)
+}
+
+// findingStrCompare compares string representation of findings pointwise by fields.
+func findingStrCompare(finding1, finding2 Finding) bool {
+	symCmp := strings.Compare(finding1.Symbol, finding2.Symbol)
+	if symCmp == -1 {
+		return true
+	} else if symCmp == 1 {
+		return false
+	}
+
+	typeStr1 := fmt.Sprintf("%v", finding1.Type)
+	typeStr2 := fmt.Sprintf("%v", finding2.Type)
+	typeCmp := strings.Compare(typeStr1, typeStr2)
+	if typeCmp == -1 {
+		return true
+	} else if typeCmp == 1 {
+		return false
+	}
+
+	posStr1 := fmt.Sprintf("%v", finding1.Position)
+	posStr2 := fmt.Sprintf("%v", finding2.Position)
+	posCmp := strings.Compare(posStr1, posStr2)
+	if posCmp == -1 {
+		return true
+	} else if posCmp == 1 {
+		return false
+	}
+
+	traceStr1 := fmt.Sprintf("%v", finding1.Trace)
+	traceStr2 := fmt.Sprintf("%v", finding2.Trace)
+	traceCmp := strings.Compare(traceStr1, traceStr2)
+	if traceCmp == 1 {
+		return false
+	}
+
+	return true
+}
diff --git a/vulndb/internal/audit/slicing.go b/vulndb/internal/audit/slicing.go
new file mode 100644
index 0000000..b976f16
--- /dev/null
+++ b/vulndb/internal/audit/slicing.go
@@ -0,0 +1,54 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package audit
+
+import (
+	"golang.org/x/tools/go/callgraph"
+	"golang.org/x/tools/go/ssa"
+)
+
+// forwardReachableFrom computes the set of functions forward reachable from `sources`.
+// A function f is reachable from a function g if f is an anonymous function defined
+// in g or a function called in g as given by the callgraph `cg`.
+func forwardReachableFrom(sources map[*ssa.Function]bool, cg *callgraph.Graph) map[*ssa.Function]bool {
+	m := make(map[*ssa.Function]bool)
+	for s := range sources {
+		forward(s, cg, m)
+	}
+	return m
+}
+
+func forward(f *ssa.Function, cg *callgraph.Graph, seen map[*ssa.Function]bool) {
+	if _, ok := seen[f]; ok {
+		return
+	}
+	seen[f] = true
+	var buf [10]*ssa.Value // avoid alloc in common case
+	for _, b := range f.Blocks {
+		for _, instr := range b.Instrs {
+			switch i := instr.(type) {
+			case ssa.CallInstruction:
+				for _, c := range siteCallees(i, cg) {
+					forward(c, cg, seen)
+				}
+			default:
+				for _, op := range i.Operands(buf[:0]) {
+					if fn, ok := (*op).(*ssa.Function); ok {
+						forward(fn, cg, seen)
+					}
+				}
+			}
+		}
+	}
+}
+
+// pruneSlice removes functions in `slice` that are in `toPrune`.
+func pruneSlice(slice map[*ssa.Function]bool, toPrune map[*ssa.Function]bool) {
+	for f := range slice {
+		if _, ok := toPrune[f]; !ok {
+			delete(slice, f)
+		}
+	}
+}
diff --git a/vulndb/internal/audit/slicing_test.go b/vulndb/internal/audit/slicing_test.go
new file mode 100644
index 0000000..782b6c3
--- /dev/null
+++ b/vulndb/internal/audit/slicing_test.go
@@ -0,0 +1,55 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package audit
+
+import (
+	"reflect"
+	"testing"
+
+	"golang.org/x/tools/go/callgraph/cha"
+	"golang.org/x/tools/go/packages/packagestest"
+	"golang.org/x/tools/go/ssa"
+)
+
+// funcsToString returns a set of function names for `funcs`.
+func funcsToString(funcs map[*ssa.Function]bool) map[string]bool {
+	fs := make(map[string]bool)
+	for f := range funcs {
+		fs[dbFuncName(f)] = true
+	}
+	return fs
+}
+
+func TestSlicing(t *testing.T) {
+	e := packagestest.Export(t, packagestest.Modules, []packagestest.Module{
+		{
+			Name:  "some/module",
+			Files: map[string]interface{}{"slice/slice.go": readFile(t, "testdata/slice.go")},
+		},
+	})
+	prog, pkgs, _, err := loadAndBuildPackages(e, "/module/slice/slice.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	pkg := pkgs[0]
+	sources := map[*ssa.Function]bool{pkg.Func("Apply"): true, pkg.Func("Do"): true}
+	fs := funcsToString(forwardReachableFrom(sources, cha.CallGraph(prog)))
+	want := map[string]bool{
+		"Apply":   true,
+		"Apply$1": true,
+		"X":       true,
+		"Y":       true,
+		"Do":      true,
+		"Do$1":    true,
+		"Do$1$1":  true,
+		"debug":   true,
+		"A.Foo":   true,
+		"B.Foo":   true,
+	}
+	if !reflect.DeepEqual(want, fs) {
+		t.Errorf("want %v; got %v", want, fs)
+	}
+}
diff --git a/vulndb/internal/audit/testdata/a_dep.go b/vulndb/internal/audit/testdata/a_dep.go
new file mode 100644
index 0000000..56e3664
--- /dev/null
+++ b/vulndb/internal/audit/testdata/a_dep.go
@@ -0,0 +1,43 @@
+// go:build ignore
+
+package A
+
+import (
+	"thirdparty.org/vulnerabilities/vuln"
+)
+
+type I interface {
+	Vuln()
+}
+
+func A1() I {
+	v := vuln.VulnData{}
+	v.Vuln() // vuln use
+	return v
+}
+
+func A2() func() {
+	return vuln.Vuln
+}
+
+func A3() func() {
+	return func() {}
+}
+
+type vulnWrap struct {
+	V I
+}
+
+func A4(f func(i I)) vulnWrap {
+	f(vuln.VulnData{})
+	return vulnWrap{}
+}
+
+func doWrap(i I) {
+	w := vulnWrap{}
+	w.V = i
+}
+
+// Part of a test program consisting of packages found
+// in top_package.go, b_dep.go, and vuln.go. For more
+// details, see testProgAndEnv function in helpers_test.go.
diff --git a/vulndb/internal/audit/testdata/b_dep.go b/vulndb/internal/audit/testdata/b_dep.go
new file mode 100644
index 0000000..2090059
--- /dev/null
+++ b/vulndb/internal/audit/testdata/b_dep.go
@@ -0,0 +1,22 @@
+// go:build ignore
+
+package B
+
+import (
+	"a.org/A"
+)
+
+type internal struct{}
+
+func (i internal) Vuln() {}
+
+func B1() {
+	A.A1() // transitive vuln use but should not be reported
+	var i A.I
+	i = internal{}
+	i.Vuln() // no vuln use
+}
+
+// Part of a test program consisting of packages found in
+// vuln.go, a_dep.go, and b_dep.go. For more details, see
+// testProgAndEnv function in helpers_test.go.
diff --git a/vulndb/internal/audit/testdata/dbs/bogus.db.org/bogus.org/module.json b/vulndb/internal/audit/testdata/dbs/bogus.db.org/bogus.org/module.json
new file mode 100644
index 0000000..222d03e
--- /dev/null
+++ b/vulndb/internal/audit/testdata/dbs/bogus.db.org/bogus.org/module.json
@@ -0,0 +1,21 @@
+[
+  {
+    "package": {
+      "name": "bogus.org/module/vuln"
+    },
+    "affects": {
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "fixed": "v2.0.0"
+        }
+      ]
+    },
+    "ecosystem_specific": {
+      "symbols": [
+        "Bogus"
+      ],
+      "url": "bogus.org/bogus/README.doc"
+    }
+  }
+]
diff --git a/vulndb/internal/audit/testdata/dbs/bogus.db.org/index.json b/vulndb/internal/audit/testdata/dbs/bogus.db.org/index.json
new file mode 100644
index 0000000..b7fa1b0
--- /dev/null
+++ b/vulndb/internal/audit/testdata/dbs/bogus.db.org/index.json
@@ -0,0 +1,3 @@
+{
+	"bogus.org/module/vuln": "2020-03-06T09:21:06.31369157-07:00"
+}
diff --git a/vulndb/internal/audit/testdata/dbs/golang.deepgo.org/index.json b/vulndb/internal/audit/testdata/dbs/golang.deepgo.org/index.json
new file mode 100644
index 0000000..9129812
--- /dev/null
+++ b/vulndb/internal/audit/testdata/dbs/golang.deepgo.org/index.json
@@ -0,0 +1,3 @@
+{
+	"thirdparty.org/vulnerabilities/vuln": "2020-04-05T10:21:50.21362171-07:00"
+}
diff --git a/vulndb/internal/audit/testdata/dbs/golang.deepgo.org/thirdparty.org/README b/vulndb/internal/audit/testdata/dbs/golang.deepgo.org/thirdparty.org/README
new file mode 100644
index 0000000..37db9a9
--- /dev/null
+++ b/vulndb/internal/audit/testdata/dbs/golang.deepgo.org/thirdparty.org/README
@@ -0,0 +1,4 @@
+Contains json files modeling vulnerability info for the module
+`thirdparty.org/vulnerabilities`.
+
+Also used for testing the robustness of loading a local vulnerability database.
diff --git a/vulndb/internal/audit/testdata/dbs/golang.deepgo.org/thirdparty.org/vulnerabilities.json b/vulndb/internal/audit/testdata/dbs/golang.deepgo.org/thirdparty.org/vulnerabilities.json
new file mode 100644
index 0000000..cfc4d70
--- /dev/null
+++ b/vulndb/internal/audit/testdata/dbs/golang.deepgo.org/thirdparty.org/vulnerabilities.json
@@ -0,0 +1,70 @@
+[
+  {
+    "package": {
+      "name": "thirdparty.org/vulnerabilities/vuln"
+    },
+    "affects": {
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "introduced": "v1.0.0",
+          "fixed": "v1.0.4"
+        },
+        {
+          "type": "SEMVER",
+          "introduced": "v1.1.2"
+        }
+      ]
+    },
+    "ecosystem_specific": {
+      "symbols": [
+        "VulnData.Vuln",
+        "VulnData.VulnOnPtr"
+      ],
+      "url": "thirdparty.org/vulnerabilities/README.doc"
+    }
+  },
+  {
+    "package": {
+      "name": "thirdparty.org/vulnerabilities/vuln"
+    },
+    "affects": {
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "introduced": "v1.2.0",
+          "fixed": "v1.3.2"
+        }
+      ]
+    },
+    "ecosystem_specific": {
+      "goarch": [
+        "amd64"
+      ],
+      "goos": [
+        "linux"
+      ],
+      "url": "thirdparty.org/vulnerabilities/README_amd64.doc"
+    }
+  },
+  {
+    "package": {
+      "name": "thirdparty.org/vulnerabilities/vuln"
+    },
+    "affects": {
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "introduced": "v1.0.1",
+          "fixed": "v1.0.2"
+        }
+      ]
+    },
+    "ecosystem_specific": {
+      "symbols": [
+        "VG"
+      ],
+      "url": "thirdparty.org/vulnerabilities/README_global.doc"
+    }
+  }
+]
diff --git a/vulndb/internal/audit/testdata/slice.go b/vulndb/internal/audit/testdata/slice.go
new file mode 100644
index 0000000..5fbbe68
--- /dev/null
+++ b/vulndb/internal/audit/testdata/slice.go
@@ -0,0 +1,57 @@
+// go:build ignore
+
+package testdata
+
+func X() {}
+func Y() {}
+
+// not reachable
+func id(i int) int {
+	return i
+}
+
+// not reachable
+func inc(i int) int {
+	return i + 1
+}
+
+func Apply(b bool, h func()) {
+	if b {
+		func() {
+			print("applied")
+		}()
+		return
+	}
+	h()
+}
+
+type I interface {
+	Foo()
+}
+
+type A struct{}
+
+func (a A) Foo() {}
+
+// not reachable
+func (a A) Bar() {}
+
+type B struct{}
+
+func (b B) Foo() {}
+
+func debug(s string) {
+	print(s)
+}
+
+func Do(i I, input string) {
+	debug(input)
+
+	i.Foo()
+
+	func(x string) {
+		func(l int) {
+			print(l)
+		}(len(x))
+	}(input)
+}
diff --git a/vulndb/internal/audit/testdata/top_package.go b/vulndb/internal/audit/testdata/top_package.go
new file mode 100644
index 0000000..8b045b8
--- /dev/null
+++ b/vulndb/internal/audit/testdata/top_package.go
@@ -0,0 +1,34 @@
+// go:build ignore
+
+package T
+
+import (
+	"a.org/A"
+	"b.org/B"
+	"thirdparty.org/vulnerabilities/vuln"
+)
+
+func T1(x bool) {
+	print(vuln.VG) // vuln use
+	if x {
+		A.A1().Vuln() // vuln use
+	} else {
+		B.B1() // no vuln use
+	}
+}
+
+func T2(x bool) {
+	if x {
+		A.A2()() // vuln use. The return value of A.A2() is stored in register t0
+	} else {
+		A.A3()()
+		w := A.A4(benign)
+		w.V.Vuln() // no vuln use with vta-vta
+	}
+}
+
+func benign(i A.I) {}
+
+// Part of a test program consisting of packages found in
+// vuln.go, a_dep.go, and b_dep.go. For more details,
+// see testProgAndEnv function in helpers_test.go
diff --git a/vulndb/internal/audit/testdata/vuln.go b/vulndb/internal/audit/testdata/vuln.go
new file mode 100644
index 0000000..c981eff
--- /dev/null
+++ b/vulndb/internal/audit/testdata/vuln.go
@@ -0,0 +1,17 @@
+// go:build ignore
+
+package vuln
+
+var VG int
+
+type VulnData struct{}
+
+func (v VulnData) Vuln() {}
+
+func Vuln() {
+	print(VG)
+}
+
+// Part of a test program consisting of packages found in
+// top_package.go, a_dep.go, and b_dep.go. For more details,
+// see testProgAndEnv function in helpers_test.go.
diff --git a/vulndb/internal/audit/utils.go b/vulndb/internal/audit/utils.go
new file mode 100644
index 0000000..c7395a7
--- /dev/null
+++ b/vulndb/internal/audit/utils.go
@@ -0,0 +1,212 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package audit
+
+import (
+	"bytes"
+	"fmt"
+	"go/token"
+	"go/types"
+	"strings"
+
+	"golang.org/x/tools/go/callgraph"
+	"golang.org/x/tools/go/types/typeutil"
+
+	"golang.org/x/tools/go/ssa"
+
+	"golang.org/x/vulndb/osv"
+)
+
+// instrPosition gives the position of `instr`. Returns empty token.Position
+// if no file information on `instr` is available.
+func instrPosition(instr ssa.Instruction) *token.Position {
+	pos := instr.Parent().Prog.Fset.Position(instr.Pos())
+	return &pos
+}
+
+// valPosition gives the position of `v` inside of `f`. Assumes `v` is used in
+// `f`. Returns empty token.Position if no file information on `f` is available.
+func valPosition(v ssa.Value, f *ssa.Function) *token.Position {
+	pos := f.Prog.Fset.Position(v.Pos())
+	return &pos
+}
+
+// funcPosition gives the position of `f`. Returns empty token.Position
+// if no file information on `f` is available.
+func funcPosition(f *ssa.Function) *token.Position {
+	pos := f.Prog.Fset.Position(f.Pos())
+	return &pos
+}
+
+// siteCallees computes a set of callees for call site `call` given program `callgraph`.
+func siteCallees(call ssa.CallInstruction, callgraph *callgraph.Graph) []*ssa.Function {
+	var matches []*ssa.Function
+
+	node := callgraph.Nodes[call.Parent()]
+	if node == nil {
+		return nil
+	}
+
+	for _, edge := range node.Out {
+		callee := edge.Callee.Func
+		// Skip synthetic functions wrapped around source functions.
+		if edge.Site == call && callee.Synthetic == "" {
+			matches = append(matches, callee)
+		}
+	}
+	return matches
+}
+
+func callName(call ssa.CallInstruction) string {
+	if !call.Common().IsInvoke() {
+		return fmt.Sprintf("%s.%s", call.Parent().Pkg.Pkg.Path(), call.Common().Value.Name())
+	}
+	buf := new(bytes.Buffer)
+	types.WriteType(buf, call.Common().Value.Type(), nil)
+	return fmt.Sprintf("%s.%s", buf, call.Common().Method.Name())
+}
+
+func unresolved(call ssa.CallInstruction) bool {
+	if call == nil {
+		return false
+	}
+	return call.Common().StaticCallee() == nil
+}
+
+// pkgsProgram returns the single common program to which all pkgs belong, if such.
+// Otherwise, returns nil.
+func pkgsProgram(pkgs []*ssa.Package) *ssa.Program {
+	var prog *ssa.Program
+	for _, pkg := range pkgs {
+		if prog == nil {
+			prog = pkg.Prog
+		} else if prog != pkg.Prog {
+			return nil
+		}
+	}
+	return prog
+}
+
+// globalUses returns a list of global uses by an instruction.
+// Global function callees are disregarded as they are preferred as call uses.
+func globalUses(instr ssa.Instruction) []*ssa.Value {
+	ops := instr.Operands(nil)
+	if _, ok := instr.(ssa.CallInstruction); ok {
+		ops = ops[1:]
+	}
+
+	var glbs []*ssa.Value
+	for _, o := range ops {
+		if _, ok := (*o).(*ssa.Global); ok {
+			glbs = append(glbs, o)
+		}
+	}
+	return glbs
+}
+
+// Computes function name consistent with the function namings used in vulnerability
+// databases. Effectively, a qualified name of a function local to its enclosing package.
+// If a receiver is a pointer, this information is not encoded in the resulting name. The
+// name of anonymous functions is simply "". The function names are unique subject to the
+// enclosing package, but not globally.
+//
+// Examples:
+//   func (a A) foo (...) {...}  -> A.foo
+//   func foo(...) {...}         -> foo
+//   func (b *B) bar (...) {...} -> B.bar
+func dbFuncName(f *ssa.Function) string {
+	var typeFormat func(t types.Type) string
+	typeFormat = func(t types.Type) string {
+		switch tt := t.(type) {
+		case *types.Pointer:
+			return typeFormat(tt.Elem())
+		case *types.Named:
+			return tt.Obj().Name()
+		default:
+			return types.TypeString(t, func(p *types.Package) string { return "" })
+		}
+	}
+	selectBound := func(f *ssa.Function) types.Type {
+		// If f is a "bound" function introduced by ssa for a given type, return the type.
+		// When "f" is a "bound" function, it will have 1 free variable of that type within
+		// the function. This is subject to change when ssa changes.
+		if len(f.FreeVars) == 1 && strings.HasPrefix(f.Synthetic, "bound ") {
+			return f.FreeVars[0].Type()
+		}
+		return nil
+	}
+	selectThunk := func(f *ssa.Function) types.Type {
+		// If f is a "thunk" function introduced by ssa for a given type, return the type.
+		// When "f" is a "thunk" function, the first parameter will have that type within
+		// the function. This is subject to change when ssa changes.
+		params := f.Signature.Params() // params.Len() == 1 then params != nil.
+		if strings.HasPrefix(f.Synthetic, "thunk ") && params.Len() >= 1 {
+			if first := params.At(0); first != nil {
+				return first.Type()
+			}
+		}
+		return nil
+	}
+	var qprefix string
+	if recv := f.Signature.Recv(); recv != nil {
+		qprefix = typeFormat(recv.Type())
+	} else if btype := selectBound(f); btype != nil {
+		qprefix = typeFormat(btype)
+	} else if ttype := selectThunk(f); ttype != nil {
+		qprefix = typeFormat(ttype)
+	}
+
+	if qprefix == "" {
+		return f.Name()
+	}
+	return qprefix + "." + f.Name()
+}
+
+// memberFuncs returns functions associated with the `member`:
+// 1) `member` itself if `member` is a function
+// 2) `member` methods if `member` is a type
+// 3) empty list otherwise
+func memberFuncs(member ssa.Member, prog *ssa.Program) []*ssa.Function {
+	switch t := member.(type) {
+	case *ssa.Type:
+		methods := typeutil.IntuitiveMethodSet(t.Type(), &prog.MethodSets)
+		var funcs []*ssa.Function
+		for _, m := range methods {
+			if f := prog.MethodValue(m); f != nil {
+				funcs = append(funcs, f)
+			}
+		}
+		return funcs
+	case *ssa.Function:
+		return []*ssa.Function{t}
+	default:
+		return nil
+	}
+}
+
+// Returns the path of a package `f` belongs to. Covers both
+// the case when `f` is an anonymous and a synthetic function.
+func pkgPath(f *ssa.Function) string {
+	// Handle all user defined functions.
+	if p := f.Package(); p != nil && p.Pkg != nil {
+		return p.Pkg.Path()
+	}
+	// Cover synthetic functions as well.
+	if o := f.Object(); o != nil && o.Pkg() != nil {
+		return o.Pkg().Path()
+	}
+	// Not reachable in principle.
+	return ""
+}
+
+// serialize transforms []*osv.Entry into []osv.Entry as to
+// allow serialization of Finding.
+func serialize(vulns []*osv.Entry) []osv.Entry {
+	var vs []osv.Entry
+	for _, v := range vulns {
+		vs = append(vs, *v)
+	}
+	return vs
+}
diff --git a/vulndb/internal/audit/version.go b/vulndb/internal/audit/version.go
new file mode 100644
index 0000000..47a38ab
--- /dev/null
+++ b/vulndb/internal/audit/version.go
@@ -0,0 +1,62 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package audit
+
+import (
+	"golang.org/x/tools/go/packages"
+)
+
+// Returns module version of a package pkg. If the version is "" and the module is
+// replaced by another module with the same path, replaced module version is returned.
+// TODO(zpavlinovic): check if this is complete/correct.
+func version(pkg *packages.Package) string {
+	module := pkg.Module
+	if module == nil {
+		return ""
+	}
+
+	if module.Version != "" {
+		return module.Version
+	}
+
+	if module.Replace == nil || module.Replace.Path != module.Path {
+		return ""
+	}
+	return module.Replace.Version
+}
+
+// populateVersionInfo recursively populates pkgVersions for the input package pkg and its transitive dependencies.
+func populatePkgVersions(pkg *packages.Package, pkgVersions map[string]string, seen map[string]bool) {
+	if _, ok := seen[pkg.PkgPath]; ok {
+		return
+	}
+	seen[pkg.PkgPath] = true
+
+	version := version(pkg)
+	if version != "" {
+		pkgVersions[pkg.PkgPath] = version
+	}
+
+	for _, imp := range pkg.Imports {
+		populatePkgVersions(imp, pkgVersions, seen)
+	}
+}
+
+// PackageVersions computes a map from a path of every package in pkgs and
+// its transitive dependencies to their module version. If module or its
+// version are not present, the corresponding package is not in the map.
+//
+// Does not check for well-formedness of version strings. If such strings
+// exist, the produced map can lead to confusing results down the line.
+// (Well-formedness of version strings should be checked by external tools,
+// such as using golang.org/x/tools/go/packages.Load to construct pkgs.)
+func PackageVersions(pkgs []*packages.Package) map[string]string {
+	pkgVersions := make(map[string]string)
+	seen := make(map[string]bool)
+	for _, pkg := range pkgs {
+		populatePkgVersions(pkg, pkgVersions, seen)
+	}
+	return pkgVersions
+}
diff --git a/vulndb/internal/audit/version_test.go b/vulndb/internal/audit/version_test.go
new file mode 100644
index 0000000..fb55cc5
--- /dev/null
+++ b/vulndb/internal/audit/version_test.go
@@ -0,0 +1,79 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package audit
+
+import (
+	"testing"
+
+	"golang.org/x/tools/go/packages/packagestest"
+)
+
+func TestPackageVersionInfo(t *testing.T) {
+	// Export package testdata with a program depending on a vulnerability package
+	// vuln with version "v1.0.1".
+	e := packagestest.Export(t, packagestest.Modules, []packagestest.Module{
+		{
+			Name: "golang.org/vulntest",
+			Files: map[string]interface{}{
+				"testdata/testdata.go": `
+					package testdata
+
+					import (
+						"thirdparty.org/vulnerabilities/vuln"
+					)
+
+					func Lib1() {
+						vuln.Vuln()
+					}
+					`,
+			},
+		},
+		{
+			Name: "thirdparty.org/vulnerabilities@v1.0.1",
+			Files: map[string]interface{}{
+				"vuln/vuln.go": `
+					package vuln
+
+					import (
+						"abc.org/xyz/foo"
+					)
+
+					func Vuln() { foo.Foo() }
+					`,
+			},
+		},
+		{
+			Name: "abc.org/xyz@v0.0.0-20201002170205-7f63de1d35b0",
+			Files: map[string]interface{}{
+				"foo/foo.go": `
+					package foo
+
+					func Foo() { }
+					`,
+			},
+		},
+	})
+	defer e.Cleanup()
+
+	_, _, pkgs, err := loadAndBuildPackages(e, "/vulntest/testdata/testdata.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	v := PackageVersions(pkgs)
+	for _, test := range []struct {
+		path    string
+		version string
+		in      bool
+	}{
+		{"command-line-arguments", "", false},
+		{"thirdparty.org/vulnerabilities/vuln", "v1.0.1", true},
+		{"abc.org/xyz/foo", "v0.0.0-20201002170205-7f63de1d35b0", true},
+	} {
+		if version, ok := v[test.path]; ok != test.in || version != test.version {
+			t.Errorf("want package %s at version %s in=%t package-version map; got %s and %t", test.path, test.version, test.in, version, ok)
+		}
+	}
+}
diff --git a/vulndb/internal/audit/vulnerability.go b/vulndb/internal/audit/vulnerability.go
new file mode 100644
index 0000000..4ba5937
--- /dev/null
+++ b/vulndb/internal/audit/vulnerability.go
@@ -0,0 +1,22 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package audit
+
+import (
+	"golang.org/x/vulndb/osv"
+
+	"golang.org/x/vulndb/client"
+)
+
+// LoadVulnerabilities fetches vulnerabilities for pkgs in dbs. Currently,
+// no caching is enabled.
+// TODO: add cache support once it is amenable to side-effect free testing.
+func LoadVulnerabilities(dbs []string, pkgs []string) ([]*osv.Entry, error) {
+	dbClient, err := client.NewClient(dbs, client.Options{})
+	if err != nil {
+		return nil, err
+	}
+	return dbClient.Get(pkgs)
+}
diff --git a/vulndb/internal/audit/vulnerability_test.go b/vulndb/internal/audit/vulnerability_test.go
new file mode 100644
index 0000000..9b7f2de
--- /dev/null
+++ b/vulndb/internal/audit/vulnerability_test.go
@@ -0,0 +1,59 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package audit
+
+import (
+	"os"
+	"path"
+	"reflect"
+	"testing"
+
+	"golang.org/x/vulndb/osv"
+)
+
+// Testing utility function that simplifies vulns by projecting each vulnerability
+// to Path, and Symbol fields only.
+func vulnProject(vulns []*osv.Entry) map[string][]osv.Entry {
+	projVulns := make(map[string][]osv.Entry)
+	for _, vuln := range vulns {
+		projVulns[vuln.Package.Name] = append(projVulns[vuln.Package.Name],
+			osv.Entry{Package: osv.Package{Name: vuln.Package.Name}, EcosystemSpecific: osv.GoSpecific{Symbols: vuln.EcosystemSpecific.Symbols}})
+	}
+	return projVulns
+}
+
+func TestLoadVulnerabilities(t *testing.T) {
+	cd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	vulns, err := LoadVulnerabilities([]string{"file://" + path.Join(cd, "testdata/dbs/bogus.db.org"), "file://" + path.Join(cd, "testdata/dbs/golang.deepgo.org")},
+		[]string{"thirdparty.org/vulnerabilities", "bogus.org/module"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	testVulnDb := make(map[string][]osv.Entry)
+	testVulnDb["thirdparty.org/vulnerabilities/vuln"] = []osv.Entry{
+		{Package: osv.Package{Name: "thirdparty.org/vulnerabilities/vuln"},
+			EcosystemSpecific: osv.GoSpecific{Symbols: []string{"VulnData.Vuln", "VulnData.VulnOnPtr"}},
+		},
+		{Package: osv.Package{Name: "thirdparty.org/vulnerabilities/vuln"}},
+		{Package: osv.Package{Name: "thirdparty.org/vulnerabilities/vuln"},
+			EcosystemSpecific: osv.GoSpecific{Symbols: []string{"VG"}},
+		},
+	}
+	testVulnDb["bogus.org/module/vuln"] = []osv.Entry{
+		{Package: osv.Package{Name: "bogus.org/module/vuln"},
+			EcosystemSpecific: osv.GoSpecific{Symbols: []string{"Bogus"}},
+		},
+	}
+
+	projVulnDb := vulnProject(vulns)
+	if !reflect.DeepEqual(testVulnDb, projVulnDb) {
+		t.Errorf("want %v vulnerability database; got (simplified) %v", testVulnDb, projVulnDb)
+	}
+}
diff --git a/vulndb/internal/binscan/exe.go b/vulndb/internal/binscan/exe.go
new file mode 100644
index 0000000..a52c0a1
--- /dev/null
+++ b/vulndb/internal/binscan/exe.go
@@ -0,0 +1,344 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package binscan
+
+// This file is a somewhat modified version of cmd/go/internal/version/exe.go
+// that adds functionality for extracting the PCLN table.
+
+import (
+	"bytes"
+	"debug/elf"
+	"debug/macho"
+	"debug/pe"
+	"fmt"
+
+	// "internal/xcoff"
+	"io"
+	"os"
+)
+
+// An exe is a generic interface to an OS executable (ELF, Mach-O, PE, XCOFF).
+type exe interface {
+	// Close closes the underlying file.
+	Close() error
+
+	// ReadData reads and returns up to size byte starting at virtual address addr.
+	ReadData(addr, size uint64) ([]byte, error)
+
+	// DataStart returns the writable data segment start address.
+	DataStart() uint64
+
+	PCLNTab() ([]byte, uint64)
+}
+
+// openExe opens file and returns it as an exe.
+func openExe(file string) (exe, error) {
+	f, err := os.Open(file)
+	if err != nil {
+		return nil, err
+	}
+	data := make([]byte, 16)
+	if _, err := io.ReadFull(f, data); err != nil {
+		return nil, err
+	}
+	f.Seek(0, 0)
+	if bytes.HasPrefix(data, []byte("\x7FELF")) {
+		e, err := elf.NewFile(f)
+		if err != nil {
+			f.Close()
+			return nil, err
+		}
+		return &elfExe{f, e}, nil
+	}
+	if bytes.HasPrefix(data, []byte("MZ")) {
+		e, err := pe.NewFile(f)
+		if err != nil {
+			f.Close()
+			return nil, err
+		}
+		return &peExe{f, e}, nil
+	}
+	if bytes.HasPrefix(data, []byte("\xFE\xED\xFA")) || bytes.HasPrefix(data[1:], []byte("\xFA\xED\xFE")) {
+		e, err := macho.NewFile(f)
+		if err != nil {
+			f.Close()
+			return nil, err
+		}
+		return &machoExe{f, e}, nil
+	}
+	// TODO(rolandshoemaker): we cannot support XCOFF files due to the usage of internal/xcoff.
+	// Once this code is moved into the stdlib, this support can be re-enabled.
+	// if bytes.HasPrefix(data, []byte{0x01, 0xDF}) || bytes.HasPrefix(data, []byte{0x01, 0xF7}) {
+	// 	e, err := xcoff.NewFile(f)
+	// 	if err != nil {
+	// 		f.Close()
+	// 		return nil, err
+	// 	}
+	// 	return &xcoffExe{f, e}, nil
+
+	// }
+	return nil, fmt.Errorf("unrecognized executable format")
+}
+
+// elfExe is the ELF implementation of the exe interface.
+type elfExe struct {
+	os *os.File
+	f  *elf.File
+}
+
+func (x *elfExe) Close() error {
+	return x.os.Close()
+}
+
+func (x *elfExe) ReadData(addr, size uint64) ([]byte, error) {
+	for _, prog := range x.f.Progs {
+		if prog.Vaddr <= addr && addr <= prog.Vaddr+prog.Filesz-1 {
+			n := prog.Vaddr + prog.Filesz - addr
+			if n > size {
+				n = size
+			}
+			data := make([]byte, n)
+			_, err := prog.ReadAt(data, int64(addr-prog.Vaddr))
+			if err != nil {
+				return nil, err
+			}
+			return data, nil
+		}
+	}
+	return nil, fmt.Errorf("address not mapped")
+}
+
+func (x *elfExe) DataStart() uint64 {
+	for _, s := range x.f.Sections {
+		if s.Name == ".go.buildinfo" {
+			return s.Addr
+		}
+	}
+	for _, p := range x.f.Progs {
+		if p.Type == elf.PT_LOAD && p.Flags&(elf.PF_X|elf.PF_W) == elf.PF_W {
+			return p.Vaddr
+		}
+	}
+	return 0
+}
+
+func (x *elfExe) PCLNTab() ([]byte, uint64) {
+	var offset uint64
+	text := x.f.Section(".text")
+	if text != nil {
+		offset = text.Offset
+	}
+	pclntab := x.f.Section(".gopclntab")
+	if pclntab == nil {
+		pclntab = x.f.Section(".data.rel.ro.gopclntab")
+		if pclntab == nil {
+			panic("no pclntab")
+		}
+	}
+	b, err := pclntab.Data()
+	if err != nil {
+		panic(err)
+	}
+	return b, offset
+}
+
+// peExe is the PE (Windows Portable Executable) implementation of the exe interface.
+type peExe struct {
+	os *os.File
+	f  *pe.File
+}
+
+func (x *peExe) Close() error {
+	return x.os.Close()
+}
+
+func (x *peExe) imageBase() uint64 {
+	switch oh := x.f.OptionalHeader.(type) {
+	case *pe.OptionalHeader32:
+		return uint64(oh.ImageBase)
+	case *pe.OptionalHeader64:
+		return oh.ImageBase
+	}
+	return 0
+}
+
+func (x *peExe) ReadData(addr, size uint64) ([]byte, error) {
+	addr -= x.imageBase()
+	for _, sect := range x.f.Sections {
+		if uint64(sect.VirtualAddress) <= addr && addr <= uint64(sect.VirtualAddress+sect.Size-1) {
+			n := uint64(sect.VirtualAddress+sect.Size) - addr
+			if n > size {
+				n = size
+			}
+			data := make([]byte, n)
+			_, err := sect.ReadAt(data, int64(addr-uint64(sect.VirtualAddress)))
+			if err != nil {
+				return nil, err
+			}
+			return data, nil
+		}
+	}
+	return nil, fmt.Errorf("address not mapped")
+}
+
+func (x *peExe) DataStart() uint64 {
+	// Assume data is first writable section.
+	const (
+		IMAGE_SCN_CNT_CODE               = 0x00000020
+		IMAGE_SCN_CNT_INITIALIZED_DATA   = 0x00000040
+		IMAGE_SCN_CNT_UNINITIALIZED_DATA = 0x00000080
+		IMAGE_SCN_MEM_EXECUTE            = 0x20000000
+		IMAGE_SCN_MEM_READ               = 0x40000000
+		IMAGE_SCN_MEM_WRITE              = 0x80000000
+		IMAGE_SCN_MEM_DISCARDABLE        = 0x2000000
+		IMAGE_SCN_LNK_NRELOC_OVFL        = 0x1000000
+		IMAGE_SCN_ALIGN_32BYTES          = 0x600000
+	)
+	for _, sect := range x.f.Sections {
+		if sect.VirtualAddress != 0 && sect.Size != 0 &&
+			sect.Characteristics&^IMAGE_SCN_ALIGN_32BYTES == IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE {
+			return uint64(sect.VirtualAddress) + x.imageBase()
+		}
+	}
+	return 0
+}
+
+func (x *peExe) PCLNTab() ([]byte, uint64) {
+	var textOffset uint64
+	for _, section := range x.f.Sections {
+		if section.Name == ".text" {
+			textOffset = uint64(section.Offset)
+			break
+		}
+	}
+	var start, end int64
+	var section int
+	for _, symbol := range x.f.Symbols {
+		if symbol.Name == "runtime.pclntab" {
+			start = int64(symbol.Value)
+			section = int(symbol.SectionNumber - 1)
+		} else if symbol.Name == "runtime.epclntab" {
+			end = int64(symbol.Value)
+			break
+		}
+	}
+	if start == 0 || end == 0 {
+		panic("didn't find both start and enc")
+	}
+	offset := int64(x.f.Sections[section].Offset) + start
+	size := end - start
+
+	pclntab := make([]byte, size)
+	if _, err := x.os.ReadAt(pclntab, offset); err != nil {
+		panic(err)
+	}
+
+	return pclntab, textOffset
+}
+
+// machoExe is the Mach-O (Apple macOS/iOS) implementation of the exe interface.
+type machoExe struct {
+	os *os.File
+	f  *macho.File
+}
+
+func (x *machoExe) Close() error {
+	return x.os.Close()
+}
+
+func (x *machoExe) ReadData(addr, size uint64) ([]byte, error) {
+	for _, load := range x.f.Loads {
+		seg, ok := load.(*macho.Segment)
+		if !ok {
+			continue
+		}
+		if seg.Addr <= addr && addr <= seg.Addr+seg.Filesz-1 {
+			if seg.Name == "__PAGEZERO" {
+				continue
+			}
+			n := seg.Addr + seg.Filesz - addr
+			if n > size {
+				n = size
+			}
+			data := make([]byte, n)
+			_, err := seg.ReadAt(data, int64(addr-seg.Addr))
+			if err != nil {
+				return nil, err
+			}
+			return data, nil
+		}
+	}
+	return nil, fmt.Errorf("address not mapped")
+}
+
+func (x *machoExe) DataStart() uint64 {
+	// Look for section named "__go_buildinfo".
+	for _, sec := range x.f.Sections {
+		if sec.Name == "__go_buildinfo" {
+			return sec.Addr
+		}
+	}
+	// Try the first non-empty writable segment.
+	const RW = 3
+	for _, load := range x.f.Loads {
+		seg, ok := load.(*macho.Segment)
+		if ok && seg.Addr != 0 && seg.Filesz != 0 && seg.Prot == RW && seg.Maxprot == RW {
+			return seg.Addr
+		}
+	}
+	return 0
+}
+
+func (x *machoExe) PCLNTab() ([]byte, uint64) {
+	var textOffset uint64
+	text := x.f.Section("__text")
+	if text != nil {
+		textOffset = uint64(text.Offset)
+	}
+	pclntab := x.f.Section("__gopclntab")
+	if pclntab == nil {
+		panic("no pclntab")
+	}
+	b, err := pclntab.Data()
+	if err != nil {
+		panic("err")
+	}
+	return b, textOffset
+}
+
+// TODO(rolandshoemaker): we cannot support XCOFF files due to the usage of internal/xcoff.
+// Once this code is moved into the stdlib, this support can be re-enabled.
+
+// // xcoffExe is the XCOFF (AIX eXtended COFF) implementation of the exe interface.
+// type xcoffExe struct {
+// 	os *os.File
+// 	f  *xcoff.File
+// }
+//
+// func (x *xcoffExe) Close() error {
+// 	return x.os.Close()
+// }
+//
+// func (x *xcoffExe) ReadData(addr, size uint64) ([]byte, error) {
+// 	for _, sect := range x.f.Sections {
+// 		if uint64(sect.VirtualAddress) <= addr && addr <= uint64(sect.VirtualAddress+sect.Size-1) {
+// 			n := uint64(sect.VirtualAddress+sect.Size) - addr
+// 			if n > size {
+// 				n = size
+// 			}
+// 			data := make([]byte, n)
+// 			_, err := sect.ReadAt(data, int64(addr-uint64(sect.VirtualAddress)))
+// 			if err != nil {
+// 				return nil, err
+// 			}
+// 			return data, nil
+// 		}
+// 	}
+// 	return nil, fmt.Errorf("address not mapped")
+// }
+//
+// func (x *xcoffExe) DataStart() uint64 {
+// 	return x.f.SectionByType(xcoff.STYP_DATA).VirtualAddress
+// }
diff --git a/vulndb/internal/binscan/scan.go b/vulndb/internal/binscan/scan.go
new file mode 100644
index 0000000..eb57c23
--- /dev/null
+++ b/vulndb/internal/binscan/scan.go
@@ -0,0 +1,242 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package binscan contains methods for parsing Go binary files for the purpose
+// of extracting module dependency and symbol table information.
+package binscan
+
+// Code in this package is dervied from src/cmd/go/internal/version/version.go
+// and cmd/go/internal/version/exe.go.
+
+import (
+	"bytes"
+	"debug/gosym"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"net/url"
+	"runtime/debug"
+	"strings"
+)
+
+// buildInfoMagic, findVers, and readString are copied from
+// cmd/go/internal/version
+
+// The build info blob left by the linker is identified by
+// a 16-byte header, consisting of buildInfoMagic (14 bytes),
+// the binary's pointer size (1 byte),
+// and whether the binary is big endian (1 byte).
+var buildInfoMagic = []byte("\xff Go buildinf:")
+
+// findVers finds and returns the Go version and module version information
+// in the executable x.
+func findVers(x exe) string {
+	// Read the first 64kB of text to find the build info blob.
+	text := x.DataStart()
+	data, err := x.ReadData(text, 64*1024)
+	if err != nil {
+		return ""
+	}
+	for ; !bytes.HasPrefix(data, buildInfoMagic); data = data[32:] {
+		if len(data) < 32 {
+			return ""
+		}
+	}
+
+	// Decode the blob.
+	ptrSize := int(data[14])
+	bigEndian := data[15] != 0
+	var bo binary.ByteOrder
+	if bigEndian {
+		bo = binary.BigEndian
+	} else {
+		bo = binary.LittleEndian
+	}
+	var readPtr func([]byte) uint64
+	if ptrSize == 4 {
+		readPtr = func(b []byte) uint64 { return uint64(bo.Uint32(b)) }
+	} else {
+		readPtr = bo.Uint64
+	}
+	vers := readString(x, ptrSize, readPtr, readPtr(data[16:]))
+	if vers == "" {
+		return ""
+	}
+	mod := readString(x, ptrSize, readPtr, readPtr(data[16+ptrSize:]))
+	if len(mod) >= 33 && mod[len(mod)-17] == '\n' {
+		// Strip module framing.
+		mod = mod[16 : len(mod)-16]
+	} else {
+		mod = ""
+	}
+	return mod
+}
+
+// readString returns the string at address addr in the executable x.
+func readString(x exe, ptrSize int, readPtr func([]byte) uint64, addr uint64) string {
+	hdr, err := x.ReadData(addr, uint64(2*ptrSize))
+	if err != nil || len(hdr) < 2*ptrSize {
+		return ""
+	}
+	dataAddr := readPtr(hdr)
+	dataLen := readPtr(hdr[ptrSize:])
+	data, err := x.ReadData(dataAddr, dataLen)
+	if err != nil || uint64(len(data)) < dataLen {
+		return ""
+	}
+	return string(data)
+}
+
+// readBuildInfo is copied from runtime/debug
+func readBuildInfo(data string) (*debug.BuildInfo, bool) {
+	if len(data) == 0 {
+		return nil, false
+	}
+
+	const (
+		pathLine = "path\t"
+		modLine  = "mod\t"
+		depLine  = "dep\t"
+		repLine  = "=>\t"
+	)
+
+	readEntryFirstLine := func(elem []string) (debug.Module, bool) {
+		if len(elem) != 2 && len(elem) != 3 {
+			return debug.Module{}, false
+		}
+		sum := ""
+		if len(elem) == 3 {
+			sum = elem[2]
+		}
+		return debug.Module{
+			Path:    elem[0],
+			Version: elem[1],
+			Sum:     sum,
+		}, true
+	}
+
+	var (
+		info = &debug.BuildInfo{}
+		last *debug.Module
+		line string
+		ok   bool
+	)
+	// Reverse of cmd/go/internal/modload.PackageBuildInfo
+	for len(data) > 0 {
+		i := strings.IndexByte(data, '\n')
+		if i < 0 {
+			break
+		}
+		line, data = data[:i], data[i+1:]
+		switch {
+		case strings.HasPrefix(line, pathLine):
+			elem := line[len(pathLine):]
+			info.Path = elem
+		case strings.HasPrefix(line, modLine):
+			elem := strings.Split(line[len(modLine):], "\t")
+			last = &info.Main
+			*last, ok = readEntryFirstLine(elem)
+			if !ok {
+				return nil, false
+			}
+		case strings.HasPrefix(line, depLine):
+			elem := strings.Split(line[len(depLine):], "\t")
+			last = new(debug.Module)
+			info.Deps = append(info.Deps, last)
+			*last, ok = readEntryFirstLine(elem)
+			if !ok {
+				return nil, false
+			}
+		case strings.HasPrefix(line, repLine):
+			elem := strings.Split(line[len(repLine):], "\t")
+			if len(elem) != 3 {
+				return nil, false
+			}
+			if last == nil {
+				return nil, false
+			}
+			last.Replace = &debug.Module{
+				Path:    elem[0],
+				Version: elem[1],
+				Sum:     elem[2],
+			}
+			last = nil
+		}
+	}
+	return info, true
+}
+
+// ExtractPackagesAndSymbols extracts the symbols, packages, and their associated module versions
+// from a Go binary. Stripped binaries are not supported.
+func ExtractPackagesAndSymbols(binPath string) (map[string]string, map[string][]string, error) {
+	x, err := openExe(binPath)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	mod := findVers(x)
+
+	bi, ok := readBuildInfo(mod)
+	if !ok {
+		return nil, nil, err
+	}
+
+	deps := map[string]string{}
+	for _, dep := range bi.Deps {
+		if dep == nil {
+			continue
+		}
+		if dep.Replace != nil {
+			deps[dep.Replace.Path] = dep.Replace.Version
+			continue
+		}
+		deps[dep.Path] = dep.Version
+	}
+
+	pclntab, textOffset := x.PCLNTab()
+	lineTab := gosym.NewLineTable(pclntab, textOffset)
+	if lineTab == nil {
+		return nil, nil, errors.New("invalid line table")
+	}
+	tab, err := gosym.NewTable(nil, lineTab)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	packageSymbols := map[string][]string{}
+	for _, f := range tab.Funcs {
+		if f.Func == nil {
+			continue
+		}
+		symName := f.Func.BaseName()
+		if r := f.Func.ReceiverName(); r != "" {
+			if strings.HasPrefix(r, "(*") {
+				r = strings.Trim(r, "(*)")
+			}
+			symName = fmt.Sprintf("%s.%s", r, symName)
+		}
+
+		pkgName := f.Func.PackageName()
+		if pkgName == "" {
+			continue
+		}
+		pkgName, err := url.PathUnescape(pkgName)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		packageSymbols[pkgName] = append(packageSymbols[pkgName], symName)
+	}
+
+	versionedPackages := map[string]string{}
+	// TODO: this is rather inefficient, but probably fine for most programs
+	for pkg := range packageSymbols {
+		for mod, version := range deps {
+			if strings.HasPrefix(pkg, mod) {
+				versionedPackages[pkg] = version
+			}
+		}
+	}
+	return versionedPackages, packageSymbols, nil
+}