Free security for the people who keep the ecosystem running.
Open-source maintainers secure the code the whole industry depends on, and nonprofits do vital work on tight budgets. Safeguard is free for both — the full platform, including reachability analysis, SBOMs, and Griffin AI autonomous remediation, at no cost.
What's included
Full platform, free
SCA, SBOM/AIBOM, container & IaC scanning, reachability analysis, and autonomous Auto-Fix — no feature gates.
Public repo coverage
Continuously scan your public projects and their dependency trees, with fix PRs opened straight against your repos.
SBOMs for your users
Publish CycloneDX/SPDX SBOMs so downstream consumers and enterprises can trust and adopt your project.
Maintainer-friendly
Low-noise, reachability-prioritized findings — so you spend time maintaining, not triaging false positives.
Nonprofit-ready evidence
Compliance-aligned reports and SBOMs for grant, donor, and audit requirements.
Academy access
Free Safeguard Academy courses and certifications for your contributors and staff.
Who qualifies
- Maintainers of public open-source projects under an OSI-approved license.
- Registered nonprofits, NGOs, and charities (501(c)(3) or local equivalent).
- Public-good and civic-tech projects run by volunteers.
- Projects and organizations that are not primarily commercial.
How to get started
Apply
Share a link to your public repo(s) or nonprofit registration.
Verification
We confirm the project's license or the organization's nonprofit status.
Activate
Your free license is enabled; connect your repositories in minutes.
Publish trust
Ship SBOMs and a clean security posture your users can rely on.
Frequently asked questions
Which open-source licenses qualify?
Any OSI-approved license (MIT, Apache-2.0, GPL, BSD, MPL, and others). The project must be genuinely public and open source, not source-available or commercial with an OSS veneer.
Is it free forever?
The open-source and nonprofit licenses are free for as long as you remain eligible. If a project becomes a commercial product, we'll help you transition to a standard plan.
Do nonprofits need to be US-based?
No. Registered nonprofits, NGOs, and charities worldwide qualify — 501(c)(3) in the US or the equivalent registration in your country.
Can I scan private repos under this program?
The OSS program covers your public projects. Nonprofits can cover their internal/private repositories used to run the organization. For broader commercial private use, a standard plan applies.