GOVCS tells the go command which version control systems it may run for which module paths. The default allows git and hg for public modules and any tool for private ones. Tightening it to git only, or turning it off for a pattern, reduces what your build machines will execute when fetching code.
Why it exists
When the go command fetches a module directly from a repository, it runs a tool such as git. Version control tools are large programs with a history of their own security fixes, and they process data from servers you do not control. GOVCS, introduced in Go 1.16, lets you decide which ones are acceptable.
Syntax
From the Go modules reference, GOVCS is a comma separated list of rules in the form pattern:vcslist:
- Patterns are glob patterns matched against leading path elements.
- The vcslist is pipe separated, or
all, oroff. - The earliest matching pattern applies.
- Special patterns
publicandprivateare also supported. - The default is equivalent to
public:git|hg,private:all.
Example:
GOVCS=github.com:git,evil.com:off,*:git|hg
Other forms: GOVCS=*:all allows everything, and GOVCS=*:off disables version control downloads. GOPRIVATE also determines whether a module counts as private for this setting.
Choosing a setting
| Setting | Effect | Good for |
|---|---|---|
| Default | git and hg for public, anything for private | Most teams |
| public:git,private:git | Only git, everywhere | Locked down build agents |
| Specific host off | No VCS fetch from that host | Blocking a known bad source |
| *:off | No direct VCS downloads | Builds that must use a proxy or vendor directory only |
Steps to tighten safely
- Check which hosts your modules come from. Most teams use only git hosting.
- Set
GOVCSon CI agents to allow only git, for examplepublic:git,private:git. - Run a clean build with an empty cache. Anything that needed another tool will fail loudly.
- For a fully proxied setup, combine with a module proxy so public modules arrive over HTTPS, not through VCS commands.
- Document the setting next to your
GOPRIVATEconfiguration. See GOPRIVATE, GONOPROXY and GONOSUMDB.
What it does not do
GOVCS does not check module contents. Hashes in go.sum and the checksum database do that. It narrows the tools involved in fetching, which is a smaller attack surface, not a content guarantee.
Where Safeguard fits
Safeguard's dependency scanning and policy gates cover what lands in your module graph, and a free scan shows the current state of a repository.
Quick check
What is the GOVCS default?
Equivalent to public:git|hg,private:all, per the Go modules reference.
Which rule wins if two patterns match?
The earliest matching pattern in the list applies.
Sources
Last reviewed: 19 October 2026.
