Private modules and proxies

Canonical guidance

• set GOPRIVATE for private module path prefixes
• scope GONOSUMDB or GONOPROXY narrowly when needed
• keep proxy and checksum protections for public modules

Use when

• internal company modules
• mixed public and private dependency graphs
• corporate proxy or checksum policy configuration

Avoid

• disabling checksum verification for everything
• checking secrets into go env -w scripts
• debugging private module access by globally turning off protections

Preferred pattern

go env -w GOPRIVATE=example.com,github.com/acme/*

Anti-pattern

• setting GONOSUMDB=* or GONOPROXY=* just to make one private dependency work

Explanation: This anti-pattern is tempting under delivery pressure, but it throws away safety for the entire dependency graph.

Why

• private module access is a policy boundary; it should be explicit and narrowly scoped