Before go get, check that the module is not deprecated, that its latest version is not retracted, that it has no known advisories you would inherit, what it pulls in transitively, and what happens at import time. Ten minutes here costs less than removing a dependency later.
Why Go makes this more important
Go has no install scripts, but code you import runs inside your program. The Go team notes that within a build there is no security boundary, since any contributing package can define an init function. Dependencies are trusted code, so vet them like code you would review.
The checklist
- Need. Can the standard library do it in a few lines? Fewer modules mean less to maintain.
- Identity. Confirm the import path is the real project. Typosquatted paths exist, so copy the path from the project's own documentation and check the repository owner.
- Status. Run
go list -m -u example.com/moduleafter adding it to a scratch module. Look for a deprecation message or retracted versions. See how to check for deprecation. - Weight. In the scratch module, run
go mod graphand count what arrives with it. A small helper that adds forty modules is a bigger decision than it looks. - Advisories. Run a scan on the scratch module. Check the Go vulnerability database at pkg.go.dev/vuln for the module name.
- Import side effects. Search the module for
func init(), global variables that start goroutines, and network calls on import. - Build features. Look for cgo and for
//go:generatedirectives, which affect what your build needs and runs. - Maintenance. Look at release cadence and how the maintainers handled past security reports. A tagged release history beats a single pseudo-version.
- License. Confirm it is compatible with your use. See what pkg.go.dev shows for licenses.
- Pin. Add the module at a tagged version, not a branch, and let review see the go.mod and go.sum change.
Quick scoring grid
| Signal | Comfortable | Needs a second look |
|---|---|---|
| Version | Tagged release | Pseudo-version |
| Status | Active | Deprecated notice |
| Weight | Few transitive modules | Dozens of modules |
| Import | No side effects | Network or goroutines on init |
Make it a team habit
Put the checklist in your pull request template for changes that touch go.mod. Reviewers then ask the same questions each time. Pair it with a policy gate so that new dependencies with known critical advisories cannot merge without an exception.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis and policy gates that apply to pull requests. A free scan lets you check a repository first.
Quick check
Does Go run a dependency's code when I fetch it?
No, but its init functions run once your program imports and starts it.
Is a pseudo-version a red flag?
It is a reason to look closer. It means the commit has no release tag.
Sources
Last reviewed: 19 October 2026.
