Most "free scan" tools want two things before they tell you anything. An account, and your code.
That's a hard sell for a lot of teams. You can't paste a client's package.json into a random website, and you shouldn't have to sign up just to find out whether lodash is still a problem.
So we built the free dependency scan on Gold differently. It runs in your browser. Your file is parsed on your machine and never sent to a server. No login.
What it takes
You can paste or upload:
- a
package.json - a
requirements.txt - a CycloneDX or SPDX SBOM
There's also a built in sample if you just want to see what the output looks like. Each scan covers up to 100 dependencies.
What you get back
The tool checks every dependency against the Gold corpus and shows which ones have known vulnerabilities. From there each package links to its Gold page, where you can see the CVEs, whether any are on CISA's Known Exploited Vulnerabilities list, and whether a Gold version exists.
When to use it
A few cases where we see people reach for it:
- Before adding a dependency. Paste the candidate and its version. Thirty seconds, no ticket.
- Reviewing a vendor's SBOM. A supplier sends you a CycloneDX file during procurement. Drop it in and see what's in there before the call.
- Old projects nobody owns. The repo nobody has touched in two years still ships. Check the manifest.
What it doesn't do
It's a lookup against known vulnerabilities. It doesn't trace whether your code actually reaches the vulnerable function, it doesn't scan your source, and 100 dependencies is a real limit for big monorepos. That deeper work, reachability and fixes, is what the Safeguard platform does.
But for a fast first answer on a file you'd rather not upload anywhere, it's the quickest way we know.
Try it at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Copy this into the free scan and see what comes back:
{
"dependencies": {
"lodash": "4.17.15",
"axios": "0.21.0",
"express": "4.17.1"
}
}
Then bump each version to the latest release and scan again. Watch the list shrink.
Quick check
The scan says a package has known CVEs. Does that mean your app can be exploited?
Not necessarily. It means a vulnerable version is installed. Whether an attacker can reach the vulnerable code through your application is a separate question, and that's what reachability analysis answers.
Why does running the scan in your browser matter?
Your file never leaves your machine. That makes it safe for a client's manifest or a vendor's SBOM you've been asked to keep private.
