Famous Equations That Changed the World and What They Mean

The equations that changed the world most are the ones that turned a pattern into a tool: Pythagoras for distance, Euler's identity for waves and rotation, Newton's gravitation for orbits, Maxwell's equations for light and radio, E = mc^2 for nuclear energy, Schrödinger's equation for chemistry and chips, Boltzmann's entropy for heat, Shannon's entropy for information, and Black Scholes for pricing risk. Each one says something short and precise, and each one changed what engineers could build.

For each equation below you get what it says, a worked example with real numbers, its history from primary sources (NIST CODATA, the Nobel archives, the MacTutor archive and the original papers) and the most common misreading. Shannon's entropy then leads into the one place this list touches everyday software security: how much randomness your keys and tokens really have.

A note on scope. Safeguard builds single purpose security models and a software supply chain platform. Nothing here suggests those models do maths or physics. The security link is narrower and more practical, and we say exactly where it is.

Key takeaways

• Pythagoras was known to Babylonian scribes about a thousand years before Pythagoras, who may have been first to prove it.
• Euler's identity is the special case of e^(ix) = cos x + i sin x, published by Euler in 1748, which turns rotation into multiplication.
• Newton's gravitation appeared in the 1687 Principia. Its constant G still carries a relative uncertainty of 2.2 x 10^-5, per NIST.
• Maxwell's equations (1865) unified electricity, magnetism and light; Heaviside gave them their four equation form.
• E = mc^2 (1905) makes one gram equal to about 8.99 x 10^13 joules. Einstein's Nobel Prize was for the photoelectric effect.
• Schrödinger's equation (1926) underpins chemistry and chips, and shared the 1933 Physics prize with Dirac's work.
• Boltzmann's S = k ln W and Shannon's 1948 entropy share a form on purpose. Security needs min entropy, not average entropy.
• Black Scholes (1973, Nobel 1997) is the clearest case on this list of a model whose assumptions matter as much as its algebra.

The equations at a glance

1. The Pythagorean theorem: a^2 + b^2 = c^2

What it says

In a right angled triangle, the square of the hypotenuse (the side opposite the right angle) equals the sum of the squares of the other two sides.

Worked example

A ladder stands 3 metres from a wall and reaches 4 metres up. How long is the ladder?

c^2 = 3^2 + 4^2 = 9 + 16 = 25
c   = 5 metres

In any number of dimensions, the straight line distance is the square root of the summed squared differences: the Euclidean distance used in nearest neighbour search and clustering.

import math

def distance(p, q):
    return math.sqrt(sum((a - b) ** 2 for a, b in zip(p, q)))

print(distance((0, 0), (3, 4)))        # 5.0
print(distance((1, 2, 3), (4, 6, 15))) # 13.0

Where it came from

The MacTutor History of Mathematics archive at the University of St Andrews, the standard scholarly reference for this kind of history, says the theorem "was known to the Babylonians 1000 years earlier" than Pythagoras, who "may have been the first to prove it." MacTutor dates Pythagoras to about 570 to 490 BC and describes Plimpton 322, an Old Babylonian clay tablet held at Columbia University, from a period MacTutor places between 1900 BC and 1600 BC. The tablet lists number relationships that match right triangles.

Why it mattered

Surveying, navigation and astronomy rest on measuring distances you cannot walk. Pythagoras turns two easy measurements into a hard third one, and trigonometry and coordinate geometry start from it.

The common misreading

It holds exactly only in flat (Euclidean) geometry. Over long distances on the Earth, or in curved spacetime, it is an approximation that works over small regions.

2. Euler's identity: e^(i pi) + 1 = 0

What it says

Euler's identity connects five numbers: 0, 1, pi, e (about 2.71828, the base of natural logarithms) and i (the square root of minus one). It is the special case x = pi of a far more useful formula:

e^(i x) = cos(x) + i sin(x)

MacTutor records that Euler gave this formula in his 1748 Introductio in analysin infinitorum, the work in which he also defined mathematical analysis as the study of functions. MacTutor lists Euler's dates as 15 April 1707 to 18 September 1783.

Worked example

Read e^(i x) as "a point on a circle of radius 1, at angle x radians." At x = pi (180 degrees) you are at the point (minus 1, 0). So e^(i pi) = minus 1, and adding 1 gives 0.

You can check it in Python, and the result teaches a lesson of its own:

import cmath
print(cmath.exp(1j * cmath.pi) + 1)
# 1.2246467991473532e-16j

Not exactly zero, because pi cannot be stored exactly in binary floating point.

Why it mattered

Multiply by e^(i theta) and you rotate by theta. That lets engineers treat alternating current and radio waves as spinning arrows (phasors) and lets the Fourier transform split any signal into frequencies, which every audio codec and wireless modem relies on.

The common misreading

It is often presented as mystical. It is better read as a definition paying off: define the exponential of an imaginary number naturally and rotation falls out.

3. Newton's law of universal gravitation: F = G m1 m2 / r^2

What it says

Every mass attracts every other mass with a force proportional to the product of the masses and inversely proportional to the square of the distance between their centres.

Where it came from

According to MacTutor, Edmond Halley asked Newton in 1684 what orbit a body would follow under an inverse square force, and Newton replied that it would be an ellipse. Halley then persuaded him to write the full treatment, which Newton published in 1687 as Philosophiae naturalis principia mathematica. MacTutor notes that Newton had shown that Kepler's law of equal areas follows from a central force, giving the physical meaning behind Kepler's observations.

The constant G

Newton's law needs a number to set the scale. NIST's CODATA 2022 value is:

G = 6.674 30(15) x 10^-11  m^3 kg^-1 s^-2
relative standard uncertainty: 2.2 x 10^-5

The "(15)" is the uncertainty in the last two digits. The speed of light, by contrast, is exact because the metre is defined from it.

Worked examples

Two 1 kilogram masses, 1 metre apart:

F = 6.674 30 x 10^-11 x 1 x 1 / 1^2
  = 6.67 x 10^-11 newtons

That is far too small to feel. Two 1,000 kg cars parked with centres 2 metres apart:

F = 6.674 30 x 10^-11 x 1000 x 1000 / 2^2
  = 1.67 x 10^-5 newtons

Still tiny. Double the distance and the force falls to a quarter; triple it and it falls to a ninth.

Why it mattered

One rule explained a falling apple and the Moon's orbit, and let astronomers predict planets, comets and tides. General relativity refines it where gravity is strong, but Newton remains the working tool for most engineering.

The common misreading

"There is no gravity in space." Astronauts float because they and their craft fall together around the Earth. A few hundred kilometres up is small next to the Earth's radius, so gravity there keeps most of its surface strength.

4. Maxwell's equations: electricity, magnetism and light in one theory

What they say

In the modern vector form, for fields in a vacuum with charges and currents:

div E  = rho / epsilon_0            (Gauss's law: charges create electric fields)
div B  = 0                          (no magnetic monopoles)
curl E = - dB/dt                    (Faraday: changing B creates E)
curl B = mu_0 J + mu_0 epsilon_0 dE/dt   (Ampere-Maxwell: currents and changing E create B)

E and B are the electric and magnetic fields, rho and J the charge and current densities; "div" measures spreading out from a point and "curl" circulation around it.

Where they came from

MacTutor records that around 1862 in London, Maxwell calculated that electromagnetic disturbances travel at approximately the speed of light, and proposed that light itself is an electromagnetic phenomenon. His full theory appeared as "A dynamical theory of the electromagnetic field" in the Philosophical Transactions of the Royal Society of London, volume 155, pages 459 to 512, dated 1865 in the Royal Society's Crossref record. MacTutor gives Maxwell's dates as 13 June 1831 to 5 November 1879.

The tidy four equation form is not quite Maxwell's. MacTutor's biography of Oliver Heaviside says Heaviside reduced Maxwell's 20 equations in 20 variables to 4 equations in 2 variables, and adds that the equations we call Maxwell's are in fact Heaviside's in form.

Worked example: the speed of light falls out

Take the last two equations in empty space (no charges, no currents). Combine them and you get a wave equation whose wave speed is:

c = 1 / sqrt(mu_0 x epsilon_0)

Two constants measured with magnets and capacitors predict the speed of light. NIST now lists c as exactly 299 792 458 metres per second. Light, radio and X rays are the same thing at different frequencies.

Why it mattered

They predicted radio waves, and every antenna, motor, fibre link and Wi-Fi chip is engineered with them. They also set up the puzzle behind special relativity: one speed for light, regardless of who is moving.

The common misreading

"Electricity and magnetism are different forces." They are two faces of one field.

5. E = mc^2: mass is a measure of energy

What it says

The energy E contained in a body at rest equals its mass m times the square of the speed of light c. Because c is huge, a small mass corresponds to an enormous energy.

Where it came from

Einstein's paper "Does the inertia of a body depend upon its energy content?" appeared in Annalen der Physik, volume 18, page 639, in 1905. The English translation dates it 27 September 1905. In it Einstein argues that if a body gives off energy L as radiation, its mass decreases by L divided by c squared, and he generalises: the mass of a body is a measure of its energy content. He even suggested a test, noting that bodies whose energy content varies strongly, such as radium salts, might let the theory be checked.

Worked example 1: one gram

E = m c^2
  = 0.001 kg x (299 792 458 m/s)^2
  = 8.99 x 10^13 joules

That is about 25 million kilowatt hours. In practice, nuclear reactions release only a small fraction of a fuel's mass as energy; the full conversion only happens when matter meets antimatter.

Worked example 2: PET scans

NIST lists the electron's mass energy equivalent as 0.510 998 950 69 MeV. When a positron (the electron's antiparticle) meets an electron, both masses disappear and two gamma rays carry the energy away, each with about 511 keV. Positron emission tomography (PET) scanners look for pairs of 511 keV photons travelling in opposite directions, which is E = mc^2 working inside a hospital every day.

Worked example 3: mass defect

NIST lists the atomic mass constant energy equivalent as 931.494 103 72 MeV. So if the parts of a nucleus weigh 0.001 atomic mass units more when separated than when bound, the binding energy is:

0.001 u x 931.494 MeV/u = 0.93 MeV

Nuclear fission and fusion release energy because the products are bound more tightly, and therefore weigh slightly less, than what went in.

Why it mattered

It explained the Sun's energy and made nuclear power possible.

The common misreadings

• "Mass turns into energy." Rest mass is a form of energy. Total energy is conserved; some moves from rest mass into kinetic energy or radiation.
• "Einstein won the Nobel Prize for relativity." The Nobel Foundation's own record says the 1921 Physics prize was awarded to Einstein "for his services to Theoretical Physics, and especially for his discovery of the law of the photoelectric effect."

6. The Schrödinger equation: how quantum states change

What it says

In its general time dependent form:

i hbar d(psi)/dt = H psi

Psi is the wave function, which encodes everything that can be predicted about a quantum system. H, the Hamiltonian, describes the system's energy. Hbar is Planck's constant divided by 2 pi. The equation says the Hamiltonian determines how the wave function evolves.

Where it came from

MacTutor records that Schrödinger published his work on wave mechanics in a series of six papers in 1926, and that he immediately saw how his approach related to Heisenberg's matrix mechanics. The Nobel Prize in Physics 1933 was awarded jointly to Schrödinger and Paul Dirac "for the discovery of new productive forms of atomic theory." MacTutor gives Schrödinger's dates as 12 August 1887 to 4 January 1961.

The constant

NIST lists Planck's constant as exactly 6.626 070 15 x 10^-34 joule seconds. Like c and the Boltzmann constant, it is fixed by definition in the current SI, which defines the kilogram from it.

Worked example: an electron in a box

The simplest solved case is a particle trapped in a one dimensional box of width L. Its allowed energies are:

E_n = n^2 h^2 / (8 m L^2),   n = 1, 2, 3, ...

Using only NIST values (h, c and the electron rest energy of 0.511 MeV), take an electron in a box 1 nanometre wide. Since h c is about 1239.84 eV nm:

E_1 = (h c)^2 / (8 x m c^2 x L^2)
    = 1239.84^2 / (8 x 510 999 x 1^2)  eV
    = 0.376 eV
E_2 = 4 x E_1 = 1.504 eV

The jump from level 1 to 2 is about 1.13 eV, a near infrared photon of about 1,100 nm. Shrink the box and the energies rise, which is why atoms and molecules absorb and emit light at specific wavelengths.

Why it mattered

Chemistry became calculable in principle, and solving the equation in a crystal explains conductors and semiconductors, the basis of transistors, lasers and LEDs. MIT OpenCourseWare's course 8.04 builds introductory quantum physics around it.

The common misreading

"Psi is a physical wave of matter." Psi is not observed directly; the square of its magnitude gives measurement probabilities.

7. Boltzmann's entropy: S = k ln W

What it says

The entropy S of a large scale state (a gas at a certain temperature and pressure, say) equals Boltzmann's constant k times the natural logarithm of W, the number of microscopic arrangements consistent with that state. More arrangements means more entropy.

Where it came from

MacTutor credits Ludwig Boltzmann (1844 to 1906) with inventing statistical mechanics, independently of Willard Gibbs, and deriving the second law from probability. Against critics he asserted, MacTutor reports, that entropy increases "almost always, rather than always." Max Planck, working on black body radiation in 1900, described turning to "the connection between entropy and probability, that is, Boltzmann's train of ideas" to make sense of his own formula, according to MacTutor's Planck biography.

The constant

NIST lists the Boltzmann constant as exactly 1.380 649 x 10^-23 joules per kelvin. It converts a pure count (a logarithm of arrangements) into the thermodynamic units engineers use.

Worked example: 100 coins

Imagine 100 coins, each heads or tails, and suppose any arrangement is allowed. The number of arrangements is W = 2^100, so:

S = k ln(2^100) = 100 x k x ln 2
  = 100 x 1.380 649 x 10^-23 x 0.6931
  = 9.57 x 10^-22 J/K

Far more arrangements have 50 heads than 90 heads, so randomly shaken coins drift toward half and half. That is the second law in miniature: systems move toward states with the most arrangements, purely by counting.

Why it mattered

It connects the steam engine to the atom: why heat flows from hot to cold and why perfect engines are impossible.

The common misreading

"Entropy is disorder." Entropy counts arrangements. One shuffled deck order is still just one arrangement, which is also why a random looking string tells you little.

8. Shannon's information entropy: H equals minus the sum of p log p

What it says

For a source that produces symbols with probabilities p1, p2, and so on, the average information per symbol is:

H = - (p1 log2 p1 + p2 log2 p2 + ... + pn log2 pn)   bits

The more unpredictable the source, the higher H.

Where it came from

Claude Shannon (30 April 1916 to 24 February 2001, per MacTutor) published "A Mathematical Theory of Communication" in the Bell System Technical Journal, volume 27, pages 379 to 423 and 623 to 656, in July and October 1948. MacTutor describes it as the paper that founded information theory.

In the paper Shannon calls base 2 units "binary digits, or more briefly bits," crediting the word to J. W. Tukey, and he notes that his H has the form of entropy in statistical mechanics, citing Boltzmann's H theorem.

Worked examples

A fair coin:

H = - (0.5 log2 0.5 + 0.5 log2 0.5) = 1 bit

A coin that lands heads 90 percent of the time:

H = - (0.9 log2 0.9 + 0.1 log2 0.1) = 0.469 bits

A password of 8 characters, each chosen uniformly at random from 62 letters and digits:

H = 8 x log2(62) = 8 x 5.954 = 47.6 bits

That last line has a condition hidden in it: "chosen uniformly at random." The formula applies to the generating process, not the string.

Why it mattered

It sets the limit for lossless compression, and Shannon's channel capacity result sets the limit for reliable transmission over noise. MIT OpenCourseWare publishes a full graduate course, 6.441 Information Theory, on the field this paper started.

The common misreading

"High entropy output means good randomness." Entropy belongs to the distribution, not to one sample; see the security section below.

9. Black Scholes: an equation that came with a warning label

What it says

For a European call option (the right, not the obligation, to buy a share at a fixed price on a fixed date), the Black Scholes value is:

C  = S N(d1) - L e^(-r t) N(d2)

d1 = ( ln(S / L) + (r + sigma^2 / 2) t ) / ( sigma sqrt(t) )
d2 = d1 - sigma sqrt(t)

S is today's share price, L the strike price, r the risk free interest rate, t the time to maturity in years, sigma the volatility, and N the cumulative normal distribution. The notation follows the Nobel committee's 1997 press release.

Where it came from

The Nobel committee's press release of 14 October 1997 says the prize went to Robert C. Merton and Myron S. Scholes "for a new method to determine the value of derivatives," developed in collaboration with Fischer Black, who died in 1995. Black and Scholes published the formula in 1973. The committee's advanced information notes that Louis Bachelier attempted option pricing in his 1900 thesis at the Sorbonne, using assumptions that allowed negative share prices, and that later work assumed log normally distributed prices instead.

Worked example

Share price 100, strike 100, one year, 5 percent interest, 20 percent volatility:

d1 = (ln(1) + (0.05 + 0.02) x 1) / (0.2 x 1) = 0.35
d2 = 0.35 - 0.2 = 0.15
C  = 100 x N(0.35) - 100 x e^(-0.05) x N(0.15)
   = 100 x 0.6368 - 95.12 x 0.5596
   = 10.45

Now double the volatility to 40 percent and the same option is worth about 18.02. The output is very sensitive to sigma, a number nobody observes directly.

Why it is a cautionary tale

The formula is mathematically sound given its assumptions: prices that move continuously and log normally, a volatility that is known and constant over the option's life, and markets where you can trade continuously without cost. Real markets break each of these at times.

The Federal Reserve's own history essay on Long Term Capital Management (LTCM) shows what model confidence plus borrowing can do. The essay describes LTCM as a hedge fund founded in February 1994, led by a team that included two Nobel laureates and "well known for using sophisticated mathematical models." By the end of 1997 it held about 30 dollars of debt for every dollar of capital, according to the essay. On 23 September 1998, fourteen banks and brokerage firms invested 3.6 billion dollars to prevent its collapse, in an arrangement the Federal Reserve facilitated without lending its own funds.

The essay does not blame a single formula, and neither should we. The risk lives in the gap between a model's assumptions and the world.

What connects these equations

Constants set the scale, and some are now exact

Two of them share a word on purpose

Boltzmann's S = k ln W and Shannon's H (minus the sum of p log p) have the same shape. For equally likely outcomes, Shannon's formula reduces to H = log2 W, and Boltzmann's to S = k ln W. Shannon drew the connection himself in 1948, and it is the bridge to software security.

From Shannon to your secrets: entropy in software security

Randomness failures usually come from the wrong generator or the wrong kind of entropy.

Step 1: know which generator you are calling

Python's documentation says the random module's generators "should not be used for security purposes." The secrets module draws on the operating system's most secure source of randomness.

import secrets

session_token = secrets.token_urlsafe(32)   # 32 random bytes, URL safe text
api_key_bytes = secrets.token_bytes(32)     # 256 bits from the OS source
pin = "".join(secrets.choice("0123456789") for _ in range(6))

The same docs say that as of 2015, 32 bytes (256 bits) was believed sufficient for typical uses, a bar that rises as computers get faster.

Search your code for the simulation generator where tokens are made:

# Find uses of the non cryptographic generator near security sensitive names
grep -rnE "random\.(random|randint|choice|getrandbits)" --include=*.py . \
  | grep -iE "token|secret|password|key|nonce|salt|otp"

Step 2: calculate design entropy from the process, not the output

For a secret drawn uniformly from an alphabet of size A, with length n:

bits = n x log2(A)

import math

def design_bits(alphabet_size: int, length: int) -> float:
    return length * math.log2(alphabet_size)

print(design_bits(62, 8))    # 47.6  (8 random alphanumerics)
print(design_bits(16, 64))   # 256.0 (64 hex characters from 32 random bytes)
print(design_bits(10, 6))    # 19.9  (6 digit PIN)

Step 3: understand why min entropy is the security number

Shannon entropy is an average. An attacker does not care about the average; they guess the most likely value first. Min entropy measures exactly that:

H_min = - log2( max p_i )

For the 90 percent heads coin, Shannon entropy is 0.469 bits but min entropy is only 0.152 bits per flip. NIST Special Publication 800-90B, "Recommendation for the Entropy Sources Used for Random Bit Generation," published in January 2018, lists min entropy among its key terms and specifies how entropy sources for random bit generators are designed and validated, including health tests. If you build or evaluate an entropy source, that is the document to read, not a Shannon calculator.

Step 4: do not "test" randomness by measuring a sample

It is tempting to compute the Shannon entropy of some output and call it good. Here is what that measures:

import math
from collections import Counter

def empirical_entropy_per_symbol(s: str) -> float:
    counts = Counter(s)
    n = len(s)
    return -sum((c / n) * math.log2(c / n) for c in counts.values())

print(empirical_entropy_per_symbol("aaaaaaaa"))   # 0.0
print(empirical_entropy_per_symbol("abcdefgh"))   # 3.0

"abcdefgh" scores the maximum yet is perfectly predictable. Empirical entropy can flag something broken; it cannot prove something secure.

Step 5: size by bits, and remember the dependencies

Pick lengths with the design formula and let the secure generator do the work; see CWE-331, CWE-332 and how long a session ID should be. The secure generator itself lives in a runtime, crypto library or OS package that gets vulnerabilities and fixes like anything else.

Where Safeguard fits, honestly

Safeguard does not do mathematics or physics; its models are single purpose security models. It does not judge how your generator is seeded or how long your tokens are, and it does not scan for secrets. The overlap is the software around the equations: numerical libraries, crypto libraries, runtimes and the images that carry them. Safeguard scans repositories, container images and SBOM files, matches components against vulnerability databases, ranks findings with reachability analysis, and shows which projects carry a given component and version.

Common mistakes

• Treating an equation as true everywhere. Pythagoras needs flat space, Newton weak gravity, Black Scholes its market assumptions.
• Saying mass "turns into" energy. E = mc^2 says rest mass is a form of energy. Total energy is conserved; it changes form.
• Calling Maxwell's four equations Maxwell's own notation. Maxwell published about 20 equations in 1865. The compact vector form is Heaviside's work.
• Using Shannon entropy to rate a secret. Security needs min entropy of the generating process. A sample's character frequencies tell you very little.
• Using a simulation random generator for tokens. Python's own docs say the random module is not for security; use secrets or your platform's equivalent.
• Ignoring floating point. cmath.exp(1j * cmath.pi) + 1 prints about 1.22 x 10^-16 i, not zero, and 0.1 + 0.2 prints 0.30000000000000004. Compare with a tolerance, not exact equality.
• Trusting a model's single output number. In the worked example, doubling volatility nearly doubled the option price. Any score built from estimated inputs deserves a sensitivity check.

FAQ

What is the most famous equation in the world?

E = mc^2 is the one most people can quote. There is no official ranking, and "most famous" is not the same as "most important."

Who really discovered the Pythagorean theorem?

Babylonian scribes knew the relationship roughly a thousand years before Pythagoras, according to the MacTutor archive. Pythagoras, or his school, may have been the first to prove it as a general theorem.

What does E = mc^2 actually mean?

The rest mass of a body is a measure of its energy content, with c^2 as the conversion factor. One gram corresponds to about 9 x 10^13 joules. Nuclear reactions release energy because their products have slightly less mass than their inputs.

Why are there four Maxwell equations?

Oliver Heaviside rewrote Maxwell's original set of about 20 equations into 4 vector equations. Two describe sources of the fields; two describe how changing fields create each other, which makes light possible.

What is the difference between Boltzmann entropy and Shannon entropy?

They have the same mathematical form. Boltzmann's counts the microscopic arrangements of a physical system and carries units of joules per kelvin. Shannon's measures the average unpredictability of a message source in bits. Shannon pointed out the connection in his 1948 paper.

How many bits of entropy does a password need?

It depends on how it is attacked and stored, and the bar rises as computers get faster. Python's documentation says that as of 2015, 32 bytes (256 bits) was considered sufficient for typical uses of its secrets module.

Why is Black Scholes considered dangerous?

The formula is not dangerous by itself. The risk comes from treating its assumptions, especially a known constant volatility and smooth price moves, as facts, and from betting heavily on its outputs. The Federal Reserve's account of LTCM in 1998 is the standard cautionary example of model driven trading combined with heavy borrowing.

Do I need these equations to work in software security?

You need Shannon's ideas, and especially min entropy, any time you generate keys, tokens or passwords. Floating point limits and model assumptions matter too.

Fix it without waiting for upstream

Equations do not have vulnerabilities, but the code that implements them does. The secure random generator behind your tokens, the numerical library behind your models and the crypto package behind your TLS connections are all open source dependencies with versions, advisories and fixes, which is where the steps below apply.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo is a real Safeguard CLI session: asked to fix a lodash CVE, it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, and pushes nothing. The same approve each step flow applies when a crypto or numerical library in your project needs an upgrade after an advisory.

Click through it at your own pace, or open it full screen.

The second demo sets up Safeguard's local runner on your own machine, approves it with a device code, and runs a scan from the terminal. On a research or data science workstation, that shows which packages and versions sit under your notebooks and simulation code; it reports on software, not on whether your maths is right.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. That lets you ask, in plain language, which of your projects carry a particular library version, while you control what the assistant can touch.

Click through it at your own pace, or open it full screen.

Want to try it on your own code? Download Safeguard and follow the CLI docs.

Quick check

Sources

• NIST CODATA: speed of light in vacuum
• NIST CODATA: Newtonian constant of gravitation
• NIST CODATA: Boltzmann constant
• NIST CODATA: Planck constant
• NIST CODATA: electron mass energy equivalent in MeV
• NIST CODATA: atomic mass constant energy equivalent in MeV
• MacTutor: Pythagoras biography
• MacTutor: Pythagoras's theorem in Babylonian mathematics
• MacTutor: Leonhard Euler biography
• MacTutor: Isaac Newton biography
• MacTutor: James Clerk Maxwell biography
• MacTutor: Oliver Heaviside biography
• Crossref record: Maxwell, A dynamical theory of the electromagnetic field, Phil. Trans. R. Soc. 1865
• Einstein, Does the Inertia of a Body Depend upon its Energy-Content? (1905, English translation, Fourmilab)
• Nobel Prize in Physics 1921: summary
• MacTutor: Erwin Schrödinger biography
• Nobel Prize in Physics 1933: summary
• MIT OpenCourseWare: 8.04 Quantum Physics I
• MacTutor: Ludwig Boltzmann biography
• MacTutor: Max Planck biography
• Shannon, A Mathematical Theory of Communication (1948, reprint, PDF)
• MacTutor: Claude Shannon biography
• MIT OpenCourseWare: 6.441 Information Theory
• Nobel Prize in Economic Sciences 1997: press release
• Nobel Prize in Economic Sciences 1997: advanced information
• Federal Reserve History: Near Failure of Long-Term Capital Management
• NIST SP 800-90B: Recommendation for the Entropy Sources Used for Random Bit Generation
• Python documentation: secrets module
• Python documentation: random module

Last reviewed: 23 October 2026.