E = mc² Explained: What Einstein's Equation Really Means

E = mc² says that an object at rest has an energy equal to its mass multiplied by the speed of light squared, so mass and energy are two measures of one quantity. Because the speed of light is 299,792,458 metres per second, one kilogram corresponds to about 9 × 10^16 joules, roughly 25 terawatt hours. In practice the equation tells you how much energy a reaction releases: when particles end up more tightly bound, the products weigh slightly less, and that small missing mass leaves as energy.

Below: what each symbol means, Einstein's 1905 paper, and worked arithmetic for binding energy, fission, fusion and the positron annihilation behind PET scans. Every constant comes from NIST's 2022 CODATA values and every isotope mass from NIST's atomic mass tables, so you can check each number.

Key takeaways

• E = mc² gives the rest energy of a mass m. The speed of light c is exact by definition: 299,792,458 m/s, so c² is about 8.988 × 10^16 m²/s².
• Einstein derived the relation in a three page paper received by Annalen der Physik on 27 September 1905. He wrote it as a mass change: if a body gives off energy L as radiation, its mass falls by L/c².
• Nuclear energy comes from mass defects. A helium-4 nucleus weighs 28.3 MeV less than two free protons and two free neutrons; that difference is its binding energy.
• One deuterium plus tritium fusion releases about 17.6 MeV. One uranium-235 fission into barium-141 and krypton-92 releases about 173 MeV promptly. Per kilogram of fuel, fusion wins by a factor of about five.
• PET scanners detect pairs of 511 keV photons, which is exactly the rest energy of an electron and a positron. Every PET image is a working application of E = mc².
• Mass is not destroyed. Nucleons rearrange into a more tightly bound state, and the released energy carries away the matching mass.
• The relation has been tested directly: a 2005 Nature study confirmed it to at least 0.00004 percent.
• Physics code is software: constants tables and numerical libraries are dependencies that change between versions, so pin them like any other package.

What does E = mc² actually say?

E = mc² is a conversion rule: mass in kilograms and energy in joules are linked by the fixed factor c², so any change in a resting system's energy is a change in its mass.

What each symbol means

• E is the rest energy, in joules: the energy of a body that is not moving as a whole, including its particles' masses, binding energy, internal motion and heat.
• m is the mass, in kilograms: the invariant (rest) mass every observer agrees on.
• c is the speed of light in vacuum. Because the SI metre is defined through it, c is no longer measured; it is fixed. NIST lists it as 299,792,458 m/s, with the uncertainty given simply as "exact".

Why c squared, and why the number is so large

The square comes from units: a joule is one kg·m²/s², so mass times a speed squared is the only way to get there. Nothing has to move at the speed of light. NIST publishes the "kilogram-joule relationship" directly: 1 kg corresponds to 8.987551787... × 10^16 J, exact, with the trailing dots marking that the decimal never ends.

c        = 299 792 458 m/s           (exact, CODATA 2022)
c^2      = 89 875 517 873 681 764 m^2/s^2
E(1 kg)  = 8.987 551 787... x 10^16 J
         = 2.4965 x 10^10 kWh        (1 kWh = 3.6 x 10^6 J by definition)
         = about 25 TWh
E(1 g)   = 8.99 x 10^13 J

No ordinary process releases all of that. Fission converts under a tenth of a percent of the fuel's mass and fusion under one percent; only matter meeting antimatter converts the full rest energy. The worked examples below put numbers on each.

Running the equation backwards

Turned around, m = E/c² (how Einstein first wrote it) tells you how much lighter a system got when it released energy:

1 kWh released      ->  3.6 x 10^6 J / c^2  = 4.0 x 10^-11 kg  (40 nanograms)
10 Wh released      ->  36 000 J / c^2      = 4.0 x 10^-13 kg  (0.4 nanograms)

A battery storing an illustrative 10 watt hours is about 0.4 nanograms lighter when flat: real, but far below what any balance can detect on a battery.

Where did E = mc² come from? The 1905 paper

Einstein's famous equation does not appear in the form E = mc² in his 1905 work. It appears in a short follow up to his paper on the electrodynamics of moving bodies, titled "Ist die Trägheit eines Körpers von seinem Energieinhalt abhängig?", published in Annalen der Physik volume 18, page 639. The English translation by W. Perrett and G. B. Jeffery, published in 1923 as "Does the Inertia of a Body Depend upon its Energy-Content?", is in the public domain and archived by John Walker at Fourmilab. The archived copy dates the paper 27 September 1905.

The argument is a thought experiment, not a measurement:

1. A body at rest emits two equal pulses of light in opposite directions, so it stays still. Total light energy: L.
2. Seen from a frame moving at steady speed v, the light carries slightly more energy than L, by a result from his earlier paper.
3. Energy is conserved in both frames. Comparing them, the body's kinetic energy in the moving frame drops by an amount that depends only on v and L.
4. The speed did not change, so the mass must have. Einstein finds it fell by L/c².

He then generalises. It does not matter that the energy left as light: "The mass of a body is a measure of its energy-content." In the units of his day, he notes that if the energy changes by L ergs, the mass changes by L/(9 × 10^20) grams. That is c² in centimetre gram second units, matching the NIST value.

Three details are worth knowing. The derivation was approximate: the paper drops terms of fourth and higher order in v/c. The notation differed: Einstein wrote V for the speed of light and L for energy, and the Fourmilab note points out that writing E for L gives E = mc² directly. And he proposed a test using radium salts, ending with the remark that radiation carries inertia between the bodies that emit and absorb it.

A dated timeline of E = mc²

What is rest energy, and how do physicists use it?

Rest energy is the energy a particle has before you count any motion. Physicists quote masses as energies: the electron's mass energy equivalent is 0.511 MeV. One electron volt is exactly 1.602176634 × 10^-19 J per NIST, and one MeV is a million of those.

From the 2022 CODATA values at NIST:

The full equation for moving objects

For a moving object of mass m and momentum p, special relativity gives the general relation:

E^2 = (p c)^2 + (m c^2)^2

total energy      E  = gamma * m c^2
gamma             = 1 / sqrt(1 - v^2/c^2)
kinetic energy    K  = (gamma - 1) * m c^2

Worked example: an electron moving at 80 percent of the speed of light.

v/c   = 0.8
gamma = 1 / sqrt(1 - 0.64) = 1 / 0.6 = 1.6667
E     = 1.6667 x 0.5110 MeV = 0.8517 MeV   (total energy)
K     = 0.6667 x 0.5110 MeV = 0.3407 MeV   (kinetic energy)
pc    = gamma x m c^2 x v/c = 0.6813 MeV
check: 0.6813^2 + 0.5110^2 = 0.4642 + 0.2611 = 0.7253 = 0.8517^2

At low speeds, (gamma minus one) times mc² reduces to the familiar one half m v², which is why Newtonian kinetic energy works perfectly well for cars and baseballs.

What about light, which has no mass?

A photon has zero mass, so the relation becomes E = pc: energy and momentum, no rest energy. A closed box of light as a whole still has a mass equal to its energy divided by c², which is the 1905 paper's closing point.

What is the mass defect, and what is nuclear binding energy?

Put a proton and a neutron on a scale separately, then bind them into a deuteron and weigh it again. The deuteron is lighter. That missing mass, multiplied by c², is the binding energy: the energy you would have to put in to pull the two apart again, and the energy that came out when they joined.

Worked example 1: the deuteron

All values in MeV from NIST CODATA 2022:

proton   938.272 089 43
neutron  939.565 421 94
sum     1877.837 511 37
deuteron 1875.612 945 00
---------------------------
binding     2.224 566 37 MeV

The deuteron is bound by about 2.22 MeV, a little over one part in a thousand of its mass. That is a small fraction, and deuterium is indeed one of the most loosely bound nuclei.

Worked example 2: helium-4

2 protons  + 2 neutrons = 1876.544 178 86 + 1879.130 843 88
                        = 3755.675 022 74 MeV
alpha particle          = 3727.379 411 8  MeV
--------------------------------------------------
binding                 =   28.295 610 9  MeV
per nucleon             =    7.07 MeV
fraction of mass        =    0.75 percent

Helium-4 is unusually tightly bound for such a light nucleus. Its four nucleons have given up three quarters of one percent of their combined mass.

The binding energy curve

Doing the same calculation for heavier nuclei, with NIST's atomic masses for the neutral atoms (using the hydrogen-1 atomic mass for each proton so that electron masses cancel), gives the pattern that explains both fission and fusion:

Binding per nucleon rises steeply from the lightest nuclei, peaks in the iron and nickel region, then falls slowly toward uranium. Any reaction that moves nucleons toward the peak releases energy:

• Joining light nuclei (fusion) climbs the steep left side.
• Splitting heavy nuclei (fission) climbs the gentle right side.

The U.S. Department of Energy's fusion explainer puts it the same way: fusion releases energy because the bound nucleus has less mass than its separate protons and neutrons, and the mass deficit is converted through E = mc².

How does E = mc² apply to nuclear fission? Worked example

Fission, as the Department of Energy describes it, is a nucleus splitting into two or more smaller nuclei plus other particles, typically after a neutron strikes it. DOE credits the 1938 discovery to Otto Hahn, Lise Meitner and Fritz Strassmann. Meitner and Otto Frisch's letter to Nature, published on 11 February 1939, gave the physical interpretation and named the process. Hahn alone received the 1944 Nobel Prize in Chemistry, presented in 1945.

Worked example 3: one uranium-235 fission

A neutron hits uranium-235. One of the many possible outcomes is barium-141, krypton-92 and three neutrons. Using NIST atomic masses in unified atomic mass units (u), and the CODATA neutron mass converted to u:

Before:  U-235              235.043 930 1 u
         neutron              1.008 664 92 u
         total              236.052 595 0 u

After:   Ba-141             140.914 403 3 u
         Kr-92               91.926 173 1 u
         3 neutrons           3.025 994 75 u
         total              235.866 571 2 u

Mass defect                   0.186 023 9 u
Energy   0.186 023 9 u x 931.494 MeV/u  = 173.3 MeV
Fraction of starting mass                = 0.079 percent

Electrons balance (92 on each side), so they cancel, and the binding energy table gives the same answer: 783.17 plus 1173.98 minus 1783.86. The fragments are radioactive and decay further, so total energy per fission is larger than this prompt figure, and this is only one of many possible channels.

Worked example 4: one kilogram of uranium-235

atoms in 1 kg  = (1000 g / 235.0439 g/mol) x 6.022 140 76 x 10^23 /mol
               = 2.562 x 10^24
energy         = 2.562 x 10^24 x 173.3 MeV x 1.602 176 634 x 10^-13 J/MeV
               = 7.11 x 10^13 J
               = about 19.8 million kWh
mass converted = 7.11 x 10^13 / c^2 = 0.79 grams

Fissioning a whole kilogram converts under a gram of mass. DOE's own comparison is that a uranium fuel pellet the size of an egg holds as much energy as 88 tons of coal.

How does E = mc² apply to nuclear fusion? Worked examples

Worked example 5: deuterium plus tritium

The reaction that fusion experiments on Earth mostly aim for joins a deuteron and a triton into an alpha particle and a neutron:

deuteron   1875.612 945 00 MeV
triton     2808.921 136 68 MeV
before     4684.534 081 68 MeV

alpha      3727.379 411 8  MeV
neutron     939.565 421 94 MeV
after      4666.944 833 7  MeV

released     17.589 248 MeV   (about 17.6 MeV)
fraction      0.375 percent of the starting mass
per kg of D-T fuel: 3.37 x 10^14 J, about 94 million kWh

Per reaction that is about a tenth of one fission; per kilogram of fuel it is nearly five times as much.

Worked example 6: how much mass the Sun loses each second

NASA describes hydrogen fusing into helium in the Sun's core at about 15 million degrees Celsius. The net effect is four hydrogen-1 atoms becoming one helium-4 atom:

4 x H-1   = 4 x 1.007 825 032 23 u = 4.031 300 128 9 u
He-4      =                        4.002 603 254 1 u
mass lost =                        0.028 696 874 8 u
energy    = 0.028 696 874 8 x 931.494 MeV = 26.73 MeV
fraction  = 0.71 percent

Part of that leaves in neutrinos; the rest heats the core. NASA's Sun fact sheet gives the solar luminosity as 382.8 × 10^24 joules per second. Dividing by c²:

3.828 x 10^26 J/s  /  8.98755 x 10^16 m^2/s^2  =  4.26 x 10^9 kg/s

About 4.26 million tonnes a second, negligible against NASA's solar mass of 1,988,400 × 10^24 kg.

Worked example 7: the National Ignition Facility shot

Lawrence Livermore National Laboratory reports that on 5 December 2022 its National Ignition Facility delivered 2.05 MJ of laser energy to a target and got 3.15 MJ of fusion energy out. Running E = mc² backwards:

3.15 x 10^6 J / c^2 = 3.5 x 10^-11 kg  =  about 35 nanograms

The whole yield corresponds to about 35 nanograms. LLNL notes many advances are still needed before inertial fusion can power homes, and the 2.05 MJ counts only laser energy delivered to the target.

Fission versus fusion versus annihilation: the numbers side by side

All energies are computed from NIST CODATA 2022 constants and NIST atomic masses. The solar row is the net of a multi step chain, not a single reaction, and some of its energy escapes as neutrinos.

How do PET scans use antimatter and E = mc²?

In 1928 Paul Dirac wrote an equation combining quantum theory and special relativity; CERN describes how its negative energy solutions pointed to antimatter. In 1932 Carl Anderson found the positron in cosmic ray tracks, the first antiparticle confirmed by experiment, and shared the 1936 Nobel Prize in Physics for it.

The U.S. National Institute of Biomedical Imaging and Bioengineering (NIBIB) explains that PET radiolabels emit positrons, each of which annihilates with an electron to produce two gamma ray photons travelling in opposite directions, with identical energies whatever the isotope. E = mc² gives that energy:

electron rest energy  0.510 998 950 69 MeV
positron rest energy  0.510 998 950 69 MeV   (same mass, opposite charge)
total                 1.021 997 901 38 MeV
shared between 2 photons going in opposite directions:
each photon           0.511 MeV = 511 keV

Detectors on opposite sides of the ring record each pair at nearly the same moment, and many such lines locate the tracer. Each one is a routine demonstration that rest mass becomes radiation at exactly the rate c².

Why antimatter is not an energy source

Annihilation converts all of the particles' rest energy, but CERN notes the universe appears to contain almost no antimatter (the matter antimatter asymmetry problem). Any antimatter we use must be made first, which costs far more energy than annihilation returns.

Does E = mc² apply to chemistry and everyday life?

Yes. It applies to every change in internal energy: a compressed spring, a hot cup of tea and a charged battery each weigh slightly more than their relaxed, cold or flat versions. Chemical reactions release a few electron volts per molecule against millions per nucleus in nuclear reactions, so chemists can treat mass as conserved for every practical purpose. Releasing one kilowatt hour lowers a system's mass by just 40 nanograms.

How has E = mc² been tested?

Cockcroft and Walton, 1932

At the beginning of 1932 John Cockcroft and Ernest Walton fired protons, accelerated by a voltage multiplier of their own design, into lithium. Helium nuclei came out. The Nobel Committee's 1951 presentation speech explains that a lithium nucleus absorbed a proton and broke into two helium nuclei, and it calls their analysis of the energy relations "a verification" of Einstein's law of mass and energy equivalence, confirmed within experimental error and later checked more exactly.

You can redo the arithmetic with modern masses:

Li-7 + H-1          = 7.016 003 436 6 + 1.007 825 032 23 = 8.023 828 468 8 u
2 x He-4            = 2 x 4.002 603 254 13               = 8.005 206 508 3 u
mass lost           = 0.018 621 960 6 u
energy released     = 0.018 621 960 6 x 931.494 MeV     = 17.35 MeV

Comparing the kinetic energy of the two helium nuclei with that mass difference is the core of the 1932 check.

Rainville and colleagues, 2005

The most quoted direct test is a 2005 Nature brief communication by Simon Rainville, James Thompson and David Pritchard of MIT with colleagues from Florida State University, Oxford and other laboratories in the United States and Europe. For isotopes of silicon and sulphur they combined two independent measurements:

• Very accurate atomic mass differences, Δm, between the nuclei involved.
• Very accurate gamma ray wavelengths, which give the energy E released, the nuclear binding energy in question.

If E = mc² holds, that energy divided by the mass difference must equal c². Their combined result was 1 minus Δmc²/E = (-1.4 ± 4.4) × 10^-7, which the authors summarise as the relation holding to at least 0.00004 percent and describe as "the most precise direct test of the famous equation yet described."

Beyond dedicated tests, reactors, accelerators, mass spectrometry tables and PET scanners rely on the relation daily; a failure would show up in all of them.

Step by step: compute the examples yourself in Python

Reproducing the examples shows a few traps that matter in any numerical code.

1. Put the constants in one place, with their source

Write the values down once, with the dataset they came from, instead of scattering literals across the code:

# constants.py: values from NIST CODATA 2022 (physics.nist.gov/cuu)
C = 299_792_458                 # m/s, exact
EV = 1.602_176_634e-19          # J, exact
N_A = 6.022_140_76e23           # 1/mol, exact
U_MEV = 931.494_103_72          # MeV per atomic mass unit
MP_MEV = 938.272_089_43         # proton
MN_MEV = 939.565_421_94         # neutron
MD_MEV = 1875.612_945_00        # deuteron
MT_MEV = 2808.921_136_68        # triton
MALPHA_MEV = 3727.379_4118      # alpha particle
ME_MEV = 0.510_998_950_69       # electron

2. Compute in the units that keep the numbers small

The mass defect is a small difference between two large numbers. Working in MeV keeps it readable:

from constants import *

def q_value(before, after):
    """Energy released in MeV: sum of rest energies before minus after."""
    return sum(before) - sum(after)

print("deuteron binding", q_value([MP_MEV, MN_MEV], [MD_MEV]))
print("D-T fusion", q_value([MD_MEV, MT_MEV], [MALPHA_MEV, MN_MEV]))
print("PET photon", ME_MEV)  # each of the two annihilation photons

Expected output, to the precision that matters: about 2.2246, 17.5892 and 0.5110.

3. Watch for lost precision

A Python float carries about 15 to 17 significant digits, and subtracting 4666.94 from 4684.53 loses three of them to cancellation. Harmless here, but errors grow over chains of differences. For every digit, use decimal arithmetic:

from decimal import Decimal, getcontext
getcontext().prec = 30
before = Decimal("1875.61294500") + Decimal("2808.92113668")
after = Decimal("3727.3794118") + Decimal("939.56542194")
print(before - after)   # 17.58924794

4. Check which constants your library actually carries

SciPy's scipy.constants module documents that it ships the 2022 CODATA recommended values, and it can look constants up by name:

python -c "import scipy.constants as sc; print(sc.physical_constants['neutron mass energy equivalent in MeV'])"
python -c "import scipy, sys; print(scipy.__version__, sys.version)"

Older library versions may carry an older CODATA set, and non exact values such as particle masses shift slightly between adjustments; SciPy defines a ConstantWarning for constants dropped from the current set. Record which version produced a result.

5. Pin the environment like any other dependency

python -m venv .venv && . .venv/bin/activate
pip install scipy
pip freeze > requirements.txt          # record exact versions
pip install --require-hashes -r requirements.lock.txt   # in CI, from a hash locked file

The last line assumes a hash locked file from your locking tool. The numbers your code prints depend on code you did not write.

Where Safeguard fits, honestly

Safeguard does not do physics, and no Safeguard model computed or checked anything in this post. Its models are built for software security work.

The connection to Safeguard is the software around the physics. Simulation codes and lab tooling are built from open source numerical libraries, notebook servers and container base images, which carry known vulnerabilities and license obligations and drift between versions, as the constants example shows. Safeguard can scan a repository, a container image or an SBOM file (for example safeguard scan --dir . or safeguard scan --image <name> from the CLI), match the components against vulnerability databases, show which projects carry a given package version, and open fix pull requests when you switch remediation on. It will not tell you whether your binding energy is right.

If your physics code uses random numbers, for example in Monte Carlo transport, a statistical generator is fine for simulation. Anything that protects secrets needs a cryptographically secure generator instead; our posts on insecure randomness and CSPRNGs cover the difference. For the place where physics and cryptography really do meet, see how quantum computing affects cryptography in the supply chain.

Common mistakes

These are the misconceptions that come up most often about E = mc².

"Mass turns into energy and disappears"

In fission and fusion the protons and neutrons are all still there afterwards. They are just more tightly bound, so the products have less rest mass, and the released energy carries exactly the missing amount. Counted as a whole system, nothing is lost.

"E = mc² is only about nuclear bombs and reactors"

It applies to every energy change, including chemistry and heating; only nuclear reactions change mass measurably.

"Einstein won the Nobel Prize for E = mc²"

The 1921 Nobel Prize in Physics, awarded in 1922, cited the law of the photoelectric effect. Relativity is not named.

"Einstein invented the atomic bomb"

The 1905 paper says nothing about splitting nuclei. Fission was discovered experimentally in 1938 by Hahn, Meitner and Strassmann.

"Objects get heavier as they go faster"

Older textbooks used a "relativistic mass". Modern physics keeps mass invariant and puts the speed dependence in energy and momentum, through E² = (pc)² + (mc²)².

"c squared means something moves at the speed of light squared"

c² is not a speed. It is the conversion factor between kilograms and joules.

"Fusion always releases more energy than fission"

Per reaction, fission wins (173 MeV against 17.6 MeV). Per kilogram of fuel, fusion releases about five times more.

"Antimatter could power the world"

Antimatter must be made before use, which costs far more energy than it returns. It serves imaging and research, not power.

FAQ

What does E = mc² mean in simple terms?

Mass is a form of energy. Anything with mass has rest energy mc², and when a system gains or loses energy its mass changes by that energy divided by c².

How much energy is in 1 kg of mass?

8.987551787 × 10^16 joules, which NIST lists as the exact kilogram-joule relationship. That is about 25 terawatt hours. No ordinary reaction releases all of it; fission releases under 0.1 percent and fusion under 1 percent.

When did Einstein publish E = mc²?

In a short 1905 paper in Annalen der Physik, dated 27 September 1905 in the archived translation. He wrote it as a mass change of L/c² for an energy L, not as E = mc².

Is E = mc² the complete equation?

No. It is the rest energy case. For a moving body the full relation is E² = (pc)² + (mc²)², where p is momentum. When p is zero you get E = mc²; when m is zero, as for light, you get E = pc.

What is the mass defect?

The mass defect is how much lighter a nucleus is than the sum of its separate protons and neutrons. Multiplied by c², it gives the binding energy. Helium-4 has a mass defect worth 28.3 MeV, about 0.75 percent of its constituents' mass.

How much energy does one uranium fission release?

For the channel uranium-235 plus a neutron giving barium-141, krypton-92 and three neutrons, the NIST masses give about 173 MeV released promptly. The radioactive fragments then decay and release more energy over time.

Why do PET scans detect 511 keV photons?

Because 511 keV is the rest energy of an electron, and a positron has the same mass. When a positron from the tracer annihilates with an electron, their combined 1.022 MeV of rest energy leaves as two photons of 511 keV each, travelling in opposite directions.

Has E = mc² ever been proven wrong?

Not in the tests covered here. The 2005 Nature test confirmed it to at least 0.00004 percent, and the Nobel Committee recognised Cockcroft and Walton's 1932 lithium work as an early verification.

Does a hot object weigh more than a cold one?

Yes, by its extra internal energy divided by c², far too little to measure on a household scale.

Fix it without waiting for upstream

Nothing here changes the physics, but physics and lab software are built from the same open source packages as everything else, so a numerical library, notebook server or container base image in your stack can carry a known vulnerability that needs patching. Where that applies, the routine below is how Safeguard helps you close the gap; where it does not, such as a vendor's closed instrument software, the fix still has to come from that vendor.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

To try it on your own machine, download Safeguard from https://safeguard.sh/download and see the CLI documentation at https://docs.safeguard.sh/docs/cli .

See how Safeguard would help

The first demo sets up Safeguard's local runner on your own machine, approves it with its device code, and then runs a scan from the terminal. Pointed at a repository of simulation or analysis code, the same flow lists the open source packages it depends on; it does not check the physics.

Click through it at your own pace, or open it full screen.

The second demo is a real Safeguard CLI session: asked to fix a lodash CVE, it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, prints a summary and pushes nothing. The same approve each step flow applies when a dependency in a scientific Python or JavaScript project needs an upgrade, and running your tests after the upgrade is how you catch a changed constant or result.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. That way you can ask an assistant which of your projects carry a given package version while you control what it can touch.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• NIST CODATA 2022 recommended values: speed of light in vacuum, kilogram-joule relationship, electron volt, Avogadro constant, unified atomic mass unit, atomic mass constant energy equivalent in MeV, electron mass energy equivalent in MeV, muon mass energy equivalent in MeV, proton mass energy equivalent in MeV, neutron mass energy equivalent in MeV, deuteron mass energy equivalent in MeV, triton mass energy equivalent in MeV, helion mass energy equivalent in MeV, alpha particle mass energy equivalent in MeV
• NIST Atomic Weights and Isotopic Compositions: hydrogen, helium, lithium, iron, krypton (all isotopes), barium (all isotopes), uranium
• Einstein, Does the Inertia of a Body Depend upon its Energy-Content? (1905), 1923 Perrett and Jeffery translation, Fourmilab archive
• NobelPrize.org: The Nobel Prize in Physics 1921
• NobelPrize.org: Carl D. Anderson, facts, Nobel Prize in Physics 1936
• NobelPrize.org: The Nobel Prize in Chemistry 1944
• NobelPrize.org: The Nobel Prize in Physics 1951
• NobelPrize.org: Nobel Prize in Physics 1951, presentation speech
• Meitner and Frisch, Disintegration of Uranium by Neutrons, Nature 143, 239 (1939)
• Rainville et al., A direct test of E=mc², Nature 438, 1096 (2005)
• U.S. Department of Energy: DOE Explains, Nuclear Fission
• U.S. Department of Energy: DOE Explains, Fusion Energy Science
• U.S. Department of Energy Office of Nuclear Energy: Fission and Fusion, What is the Difference?
• Lawrence Livermore National Laboratory: LLNL achieves fusion ignition
• NASA: Our Sun, facts
• NASA NSSDCA: Sun fact sheet
• NIH NIBIB: Nuclear medicine (PET and SPECT)
• CERN: Antimatter
• SciPy documentation: scipy.constants

Last reviewed: 23 October 2026.