Suppose there is an incoming database report for a vulnerability where the fix is patching the body of a method named Vuln :

func (b B) Vuln() {
   // ...
  + // fix
}

Manual vulnerability symbol extraction could likely add the symbol B.Vuln to the database.

But if the type B is defined as a type alias type B = A, the actual symbol name that govulncheck would see when encountering the method will be A.Vuln. In that case, govulncheck would miss the use of the vulnerable method.

@golang/vulndb