cmd/go/internal/work/security.go:225 contains the canonical allowlist.

A module containing -Wl,-sectcreate:

// #cgo LDFLAGS: -Wl,-sectcreate,__TEXT,__info,/Users/victim/.ssh/super_secret
import "C"

And a victim using CGO_ENABLED=1 and go build on darwin/arm64 will read the contents of /Users/victim/.ssh/super_secret and embed it in the binary. Since exfiltration of this information, even on a multi-user system, requires significant privilege, this is considered to be a hardening measure.