Gold is Safeguard's open source directory. It describes itself as a source of production ready open source components, checked for security, malware and license compliance. This FAQ covers what it indexes, how Gold status is decided, what pages you can open and how to use the free scan alongside it.
What does it index?
The site lists packages, container images, AI models and MCP servers. Package ecosystems named on the site include npm, Cargo, Go, Maven, GitHub Actions, PyPI and RubyGems. It also has a CVE database, a section for actively exploited vulnerabilities, zero days, a CWE index, malicious packages and a glossary. Counts on the site change often, so check the site rather than relying on a number here.
What are the Gold criteria?
The site names four pillars: no known vulnerabilities, no known malware, license compliance and complete provenance. A tooltip on the site describes Gold as no known high or critical vulnerabilities at last scan.
How fresh is it?
The site says components are re-checked as new advisories are published and that the index is continuously updated. Each package page shows a last indexed time. Use that time as your freshness check.
Is it free?
Browsing and the scan page are open without a login. The scan page says it is free with no login. Other things on the site, such as plans, are listed under pricing, which we do not cover here.
Can I check my own project?
Yes. The scan page accepts a package.json, requirements.txt or a CycloneDX or SPDX SBOM, up to 100 dependencies per run, and parses the file in your browser.
Can I add a badge to my README?
Package pages show a Gold badge and a Markdown snippet to embed it. Check the page for your package to see whether it is available.
What should I not conclude from Gold?
That a package is safe. Gold is a statement about known issues at a time. Read /resources/blog/what-gold-status-means-and-does-not-mean.
Where do I start?
- Search for a package you use.
- Read the checklist sentences, vulnerability count and health grade, as in /resources/blog/read-a-gold-package-page-section-by-section.
- Open a CVE page for any finding, as in /resources/blog/how-to-read-a-cve-page-on-gold.
- Run your manifest through gold.safeguard.sh/scan.
Quick check
Do I need an account to scan?
No. The scan page says it is free with no login.
Is Gold only for npm?
No. The site lists several ecosystems including Cargo, Go, Maven, PyPI and RubyGems.
Sources
Last reviewed: 19 October 2026.
