GOINSECURE or GOSUMDB=off: which Go setting disables what?

GOINSECURE permits insecure protocols for modules matching its patterns, but still validates against the checksum database. GOSUMDB=off stops consulting the checksum database entirely. They weaken different protections, and the second one is broader, so prefer the narrowest setting that fixes your problem.

Two layers of protection

Go protects module downloads at two layers:

• Transport: how the module is fetched, normally over HTTPS.
• Content: whether the bytes match what the checksum database and go.sum record.

Each setting touches one of them.

What the reference says

From the Go modules reference:

• GOINSECURE lists module path prefixes that may be fetched over insecure protocols. It only applies to dependencies fetched directly, and unlike the old go get -insecure flag, it does not disable checksum database validation.
• GOSUMDB defaults to sum.golang.org. If set to off, the checksum database is not consulted.
• GOPRIVATE is a default for GONOPROXY and GONOSUMDB, so listed modules skip the proxy and the checksum database.

The managing dependencies guide adds a related warning for replace directives: Go tools do not authenticate replaced external modules.

Comparison

Decision guide

1. Is the module private? Use GOPRIVATE with a tight pattern for your organization, not a wildcard.
2. Is an internal host using an insecure protocol? Prefer fixing the certificate. If you cannot yet, use GOINSECURE for only that host.
3. Is the checksum database unreachable from your network? Use a proxy that can reach it, or an internal mirror, before reaching for GOSUMDB=off.
4. If you must turn something off, record who approved it, why, and when it will be reviewed.
5. Never put these in a shared shell profile with a wildcard like *.

Common mistakes

• Setting GOSUMDB=off in a Dockerfile to silence a build error, then forgetting it. The setting ships in the image and every later build skips verification.
• Using a broad GOPRIVATE such as a whole domain that also hosts public code.
• Treating GOINSECURE as if it disabled verification, then assuming a failure means a bug in Go. A checksum failure with GOINSECURE set is the system working.

Remember too that toolchain downloads need the checksum database. With GOSUMDB=off they fail, per the Go toolchain documentation.

Where Safeguard fits

Safeguard's policies and gates can enforce rules on pull requests that change build configuration, and dependency scanning covers what your build resolves. A free scan is a starting point.

Quick check

Sources

• Go Modules Reference
• Go Toolchains
• Managing dependencies

Last reviewed: 19 October 2026.