Yes, we do this for our release builds, including Windows. It does only remove the leading prefix (GOPATH) from panics, not the full file path.

I don't think there's a way to remove the whole file paths other than replacing strings in the compiled binary. In our case GOPATH was the only sensitive part (since function names can't be removed either, for reflection to work).

We also couple it with a defer handler to obfuscate panic traces.

It didn't even remove the leading prefix for me. I tried both forward and backward slashes. (The version in the binary is with forward slashes.) Note that I'm using go1.10.3.windows-amd64.zip.

EDIT: Looking more carefully, it seems like it actually removes the prefix for files in the current module, but nothing from files in its dependencies. This is despite the fact that both of them share a prefix for me, and that's what I'm trying to remove. Any idea why?

This changed from 1.9 -> 1.10, now the asm/gc/ldflags only apply to the module being compiled directly, not other modules.

https://golang.org/doc/go1.10#build

You can resolve this by using "all" as the pattern (-gcflags=all=-trimpath=$GOPATH)

Ahh!! Okay thanks, that works... almost. Now there's still one spot left where the path of the Go installation is embedded... :\