A Go security error means the hash of a downloaded module does not match the hash recorded in go.sum or the checksum database. The go command refuses to put the file in the module cache. Do not delete go.sum to make it go away. Find out why the bytes changed first.
What the go command checks
The Go modules reference explains that after downloading a .mod or .zip file, the go command computes a cryptographic hash and compares it with the matching line in the main module's go.sum. If the hash is not in go.sum, it retrieves it from the checksum database by default. If the computed hash does not match, the command reports a security error and does not install the file in the module cache.
For zip files, the hash covers file names and contents in a deterministic order, so file order, compression and other metadata do not change it.
Likely causes
- A maintainer moved or re-tagged a version after it was first fetched. The reference notes that if a tag is modified, clients may see a security error.
- A private or forked module was fetched through a proxy while go.sum holds a hash from another source.
- A merge conflict or manual edit damaged go.sum.
- Something between you and the source altered the file. This is rare, and it is exactly what the check exists to catch.
Safe order of checks
- Read the full error. It names the module and version.
- Run
git log -p go.sumto see whether a line for that version changed recently. - Check whether the upstream tag was moved. Compare the commit the tag points to now with what your team used earlier.
- Try fetching through a different, trusted path, for example the public proxy, and compare results.
- If the module is private, confirm your private module settings are correct. See GOPRIVATE, GONOPROXY and GONOSUMDB.
- Only when you understand the cause should you update the go.sum line, in a reviewed pull request.
What not to do
Do not turn off the checksum database or set a global bypass just to get a build through. We compare the options in GOINSECURE vs GOSUMDB off. Do not copy a go.sum from an unknown machine.
If a mismatch is real and unexplained, treat it as an incident: stop builds that use the module and ask the maintainer.
Prevention
Review go.sum changes in pull requests. Understand how the proxy and checksum database fit together, as in how GOPROXY and sum.golang.org protect and can fail. Avoid depending on a tag that its maintainer is known to move.
Safeguard's dependency scanning and SBOM generation record the exact module versions you build, which gives you a baseline to compare against. There is a free scan at gold.safeguard.sh/scan.
Quick check
Is deleting go.sum a fix for a security error?
No. It removes the record that caught the difference. Investigate the cause, then update the line deliberately.
Does the failed file end up in the module cache?
No. The Go reference says the command deletes or does not install the file when the hash differs.
Sources
Last reviewed: 19 October 2026.
