Use a free lookup scan when you want a fast answer on one manifest. Move to a full scan when you need the whole dependency tree, repeat checks, reachability, policy enforcement or fixes. The deciding factor is usually how often you will do it and how many findings you must act on.
What the free scan does
The free scan at gold.safeguard.sh/scan takes a package.json, requirements.txt or a CycloneDX or SPDX SBOM, parses it in your browser and shows which packages carry known vulnerabilities, up to 100 dependencies per run. No account is needed. That is a lookup against the Gold corpus, nothing more claimed.
What a full scan adds
Transitive coverage. Scanning a repository or lockfile sees the whole tree, not just what you typed in.
Reachability. Analysis of whether your code can call the vulnerable function. Most findings in a large tree are not on a path your code uses, and reachability separates those from the ones that are.
Policies and gates. Rules that block a pull request when a new dependency violates your standard.
Continuous monitoring. New advisories arrive after your scan. A scheduled or continuous check catches them.
Fix proposals. Safeguard's autonomous remediation can open fix pull requests. It is off by default and every category starts on Manual, so a person approves changes.
A simple decision table
- One file, one time, curiosity: free scan.
- Checking a supplier's SBOM: free scan first, then ask questions.
- A product you ship, every release: full scan.
- Over 100 dependencies regularly: full scan.
- Audit evidence needed: full scan, with records.
- Need to know what is actually exploitable: full scan with reachability.
See reachability at work
Click through it at your own pace, or open it full screen.
Using both well
Many people start with the free scan to see the shape of the problem, then decide whether the volume justifies automation. That is a sensible path. If the free scan returns two findings, you may not need more today. If it returns thirty, you will want help ranking them.
The cost of doing nothing
An unmonitored dependency set drifts. Advisories land, versions age and nobody notices. Even a small team benefits from a scheduled check. Start with the free scan at gold.safeguard.sh/scan and see where it leads.
Quick check
Does the free scan trace reachability?
No. It reports known vulnerabilities for the packages you submit. Reachability analysis is part of the Safeguard platform.
Sources
Last reviewed: 19 October 2026.
