RAG in Go: A Vulnerability Research Tool

A practical walkthrough of building a RAG (Retrieval-Augmented Generation) system in Go that queries the Go Vulnerability Database. The tutorial covers two phases: ingestion (parsing vulnerability JSON from a zip file, generating vector embeddings with a Qwen3 model, and storing them in an embedded DuckDB database) and search (embedding user queries, performing cosine similarity lookups, and passing relevant documents as LLM context). Full code listings are provided using langchaingo and DuckDB with a 1024-float vector column. The post also discusses design trade-offs like batch processing, similarity thresholds, chunking strategies, and query enhancement.