Yes, you can ask the Safeguard web app chat about a package by name before you install it, and use the answer as a first pass. Then verify the points that matter, namely the exact name, the version and the fix status, against the package's source and the vulnerability record.
What does the web app give you here?
The web app at app.safeguard.sh is chat first. You can drive the platform by typing a question instead of navigating pages. The global search also accepts plain text, such as a package name or a CVE identifier, and a filter syntax for narrower questions.
That makes the pre-install check conversational. You do not need a project set up to ask about one dependency. If the package is already in a connected project, the same chat can answer in the context of what that project uses.
What should you ask?
Vague questions get vague answers. Ask for specifics you can check.
- "What known vulnerabilities affect this package, and in which versions?"
- "Which version fixes them?"
- "Is there anything in the advisory data about this name being impersonated or malicious?"
- "Is this package already in any of our projects, and which ones?"
- "If it is, are any of the listed vulnerabilities reachable from our code?"
The last two questions are where chat earns its keep. A public lookup tells you about the package in general. Your own inventory tells you whether adding or upgrading it touches something you already run.
What should you verify yourself?
A chat answer is a summary. Four things deserve a second look.
The name. Copy the package name from the project's own documentation or repository, then paste it into the chat. Never type it from memory.
The ecosystem. The same name can exist on more than one registry.
The version you will pin. Confirm the fixed version is available on your registry and compatible with your other dependencies.
The advisory. Open the linked CVE or advisory and read the affected range. Summaries can compress details that matter, such as an affected feature you do not use.
If the answer cites no source, treat it as a lead, not a finding.
When is chat the wrong tool?
Chat is a good place to start a check, not a gate. If every install in your company must pass a check, put that check in the pipeline where it runs without a person typing. Reachability analysis and scans of the full dependency list are better run on a schedule, with results kept as evidence.
Chat is also not the right place for secrets. Do not paste tokens or private code into any chat to get a faster answer.
What to do
- Open app.safeguard.sh and ask about the package by its exact name, copied from the source.
- Request affected versions, the fixed version and any malicious package notes.
- Ask whether the package or its transitive dependencies are already in your projects.
- Open the cited advisories and confirm the affected range against the version you plan to use.
- Pin the version, record the reason in the pull request, and let CI scan the change.
- If the answer is unclear, check the package in the free Gold directory at gold.safeguard.sh before deciding.
Quick check
Can the chat install or block a package for me?
Treat chat as a way to look things up and ask questions. Enforcement belongs in your build and pipeline settings.
Do I need an account to check a package?
Chat is part of the web app, so it needs sign in. The Gold directory and the in-browser scan at gold.safeguard.sh/scan are free to use without one.
Sources
- Safeguard docs: Web Application, fetched 18 October 2026
- Gold Open Source directory, fetched 18 October 2026
- Safeguard docs: Vulnerability Prioritization, fetched 18 October 2026
Last reviewed: 18 October 2026.
