The free scan at gold.safeguard.sh/scan checks up to 100 dependencies per run. For a larger project, split the manifest into slices of 100 or fewer and scan each, prioritizing direct dependencies first. If you need the whole transitive tree every time, move to an automated scanner instead.
Why there is a cap
The page states the limit and nothing more, so we will not guess at reasons. What matters is how to work within it. Files are parsed in your browser, and the scan needs no account.
Count before you scan
Know your size. A package.json lists direct dependencies only, so a manifest with 40 entries fits easily even if the installed tree is much larger. A requirements.txt that was generated by freezing an environment may list hundreds of pinned lines. An SBOM usually lists every component and can be far over 100.
Slicing a manifest
- Copy your direct dependencies first. These are the ones you chose and can change.
- Split by type. Runtime dependencies go in one batch, development tooling in another.
- For a requirements.txt with many lines, cut it into chunks of about 80, which leaves room for any miscount.
- Keep the original line order in each chunk so you can reconcile results.
- Record which chunk found what, in a simple table.
For JSON, edit a copy and keep it valid: remove entries cleanly and keep brackets and commas in order.
Monorepos
Scan each package manifest separately. Shared libraries that appear in several packages need only one result, though versions may differ between packages, so keep the version when you note a finding.
SBOMs over the limit
You can trim a CycloneDX or SPDX file in a copy, but trimming by hand is error prone. For anything beyond a one off look, an automated scan of the full file is a better fit than editing it.
Know what slicing misses
A sliced scan gives you known vulnerabilities for the packages you submitted. It does not show transitive dependencies you did not list, and it does not tell you whether your code reaches the vulnerable function. It is a lookup, not a full analysis.
When to stop slicing
If you are scanning more than a few slices a week, or the same project repeatedly, automate it. Safeguard's dependency scanning and SBOM tooling are built for full trees and continuous checks, while the free scan stays useful for quick lookups.
Quick check
Does the 100 limit apply to the file or to unique packages?
The page says up to 100 dependencies per run and does not say more. Keep each run comfortably under 100 to be safe.
Is my manifest uploaded when I scan?
The page says the file is parsed in your browser and never sent to a server.
Sources
Last reviewed: 19 October 2026.
