Company · Open Source

Open source, out and back in.

Safeguard sits on top of 11 open-source scanners and dozens of OSS libraries. This page is what we ship back to the community — the repos we maintain, the upstreams we patch, the programmes we run for maintainers and researchers, and a clean way to get involved.

What we maintain Get involved

What we maintain

Repos we ship, under permissive licences.

Each of these has its own GitHub presence, its own release cadence, and its own contributor list — including external contributors.

MIT

safeguard-cli

The Safeguard command-line tool — scan a manifest, generate an SBOM, evaluate a policy gate, ship a remediation patch. Same binary your CI pipeline runs and the same one we run in demos. Public roadmap, public issue tracker, and a release cadence that lines up with the platform.

Custom permissive

Lino on-device weights

The inline model that ships in the IDE extension. Signed weight bundles, reproducible from the published training-data manifest, distributed under a custom permissive licence that allows local use, redistribution, and modification with attribution.

Apache 2.0

Policy template library

Reference policies for SOC 2, FedRAMP, ISO 27001, PCI-DSS, NIST 800-218 — each expressed in the same policy DSL the platform evaluates. Lift any one of them out of the repo, fork it, and use it standalone with an open-source policy engine.

MIT

MCP profiles

Reference Model Context Protocol profiles for Claude Code, Cursor, and Cline. They define the tool surface and guardrails an agentic editor sees when it talks to a Safeguard-instrumented project. Drop them straight into your own MCP server config.

Upstream contributions

Where we send patches back.

We'd rather fix the upstream than fork it. These are the ecosystems we contribute to on a continuous basis.

Patches to Grype, Trivy, and the OSV scanner ecosystem

Bug fixes, ecosystem coverage extensions, and reachability-flag wiring. We treat upstream patches as the canonical fix; the platform's enrichment of these scanners sits on top of them, not in place of them.

CycloneDX and SPDX spec contributions

Concrete proposals to the SBOM standards bodies: tighter semantics for reachability annotations, conventions for vulnerability evidence, and round-trip lossless conversion between formats. Most land as PRs against the spec repos.

sigstore and cosign contributions

Patches and bug reports for signing, verification, and transparency-log workflows — particularly around offline verification and the long-tail of registry quirks that bite enterprise users.

Reachability-analysis research published to OSV

Where our analysis sharpens the reachability claim on an existing OSV entry, we propose the refinement upstream. The goal is for any open-source consumer to inherit the same precision, not just our customers.

OWASP supply chain workgroup participation

Active participation in the supply-chain SIGs at OWASP, including authorship contributions to community guides and cheat sheets on dependency hygiene, SBOM consumption, and reachability triage.

Coordinated disclosure patches submitted upstream

When our research team coordinates a disclosure with an upstream maintainer, we propose a patch with the report. The patch is the deliverable; the advisory is the documentation.

Community programmes

Free tiers, grants, and a classroom.

Open-source maintainer programme

Free Safeguard tier for any project with more than 1,000 stars on its primary host, plus an expedited path for projects flagged by the OpenSSF Critical Projects list. SBOM generation, reachability triage, and CI gates included.

Research grants

Small grants for independent security researchers working on supply-chain analysis, malicious-package detection, and reachability tooling. Lightweight application, no equity, no exclusivity.

Education programme

Free for accredited universities running courses on application or supply-chain security, and for capture-the-flag teams. Includes classroom seats, a curated finding corpus, and a lab pack with reference vulnerabilities.

Licensing posture

Audit-friendly, attribution-clean.

Every open-source dependency the platform uses is licence-audited at ingest, with a denylist for copyleft families that conflict with our distribution terms. Attribution for in-product OSS components is carried in the platform's own SBOM — generated by the same pipeline we sell. Contributor licence agreements are honoured for every external contribution to our maintained repos; the CLA text and signing record are public.

How to get involved

Four doors, all open.

File a PR

Issues and PRs welcome on every public Safeguard repository. Contribution guides cover style, signing, and the lightweight CLA we honour.

Propose a scanner

Wiring a new open-source scanner into the platform is a documented process with reference implementations. If the tool is good, we want it in.

Propose an integration

SCM, ticketing, SIEM, chatops — integration scaffolds live in their own repo. Propose one, send a PR, and we'll help you land it.

Join the community Slack

Open Slack for users, contributors, maintainers, and security researchers. Quiet, technical, moderated. Invite link in every repo's README.

Come build with us in the open.

The platform is the commercial layer. Everything below it that we can keep open, we do.