Yes. A Go binary built with module support carries its Go version, main module, every dependency that contributed packages, and build settings. You can read this with go version -m binary, or in code with runtime/debug.ReadBuildInfo. It is the quickest way to audit what actually shipped.
What is embedded
The runtime/debug documentation describes the BuildInfo struct:
| Field | Contents |
|---|---|
| GoVersion | Toolchain version that built the binary |
| Path | Package path of the main package |
| Main | Module containing the main package |
| Deps | All dependencies, direct and indirect, that contributed packages |
| Settings | Build settings as key and value pairs |
Each dependency entry has a path, version, checksum and, if replaced, the replacement module. The documented settings include CGO flags, target architecture and, for version control, vcs, vcs.revision, vcs.time and vcs.modified.
The documentation notes the information is available only in binaries built with module support.
Why it helps security work
- You can check a binary found on a server without the source repository.
vcs.modifiedtells you whether the build tree had local changes.vcs.revisionties a binary to a commit.- A
Replaceentry shows a dependency swapped for a fork. - GoVersion tells you whether the binary was built with a toolchain that has since received security fixes.
That last point matters: standard library fixes are compiled in, so updating the toolchain on your laptop does nothing for binaries already built.
Steps to audit a binary
- Run
go version -m ./yourbinaryto print the module versions recorded in it. - Note GoVersion and compare it to current supported releases.
- Check for replaced modules and pseudo-versions.
- Feed the dependency list into your vulnerability scanner, or run a binary mode scan with
govulncheck. See govulncheck source vs binary mode. - Store the output with the release record so future advisories can be matched to what you shipped.
Limits
Stripped or non module builds may lack the data. Binaries built long ago may carry old toolchain code. And the list shows modules, not which functions are called, so pair it with reachability analysis. To generate an SBOM from a binary, see how to get an SBOM from a compiled Go or Rust binary.
Where Safeguard fits
Safeguard's SBOM and dependency scanning cover Go projects, and reachability analysis helps prioritise. Try a free scan.
Quick check
Does the binary list indirect dependencies?
Yes. Deps covers all dependencies, direct and indirect, that contributed packages.
Can I tell which commit built it?
Usually, through the vcs.revision build setting, when the build recorded version control data.
Sources
Last reviewed: 19 October 2026.
