What did you do?

Compiled a striped go binary.

$ go build -ldflags="-s -w" -trimpath

What did you expect to see?

Module information stripped from the binary.

What did you see instead?

Go includes module information in the binary in runtime.modinfo.

$ go version -m hello
hello: go1.14.2
	path	example.com/user/hello
	mod	example.com/user/hello	(devel)	
	dep	github.com/google/go-cmp	v0.5.2	h1:X2ev0eStA3AbceY54o37/0PQ/UWqKEiiO2dKL5OPaFM=

In production environments, this kind of information can be used by attackers to target vulnerable dependencies. Consider allowing users to strip that information either through the current stripping flags or via a new flag.