Gold Open Source: A Free Directory for the Question Every Developer Asks Before Lunch
Somewhere between adding a dependency to a project and shipping it, most developers ask a quiet question: is this thing actually safe to use? The package looks popular, the README is confident, the download count is reassuring. None of that answers the question. What you actually want to know is whether the package has known vulnerabilities, whether any of them are being exploited right now, whether the maintainer has a history of shipping malware by accident or on purpose, and whether a safer version already exists.
Gold Open Source, at gold.safeguard.sh, exists to answer that question directly, for free, without an account.
What it actually is
Gold Open Source is a public directory, not a sales funnel dressed up as one. There is no login wall and no seat to buy before you can search. You type in a package name or a CVE and you get real data back: CVSS scores, EPSS probability of exploitation, whether CISA's Known Exploited Vulnerabilities (KEV) list includes it, which versions are affected, and which version fixes the problem. An "am I affected?" checker turns that into a direct answer instead of a research project.
The directory covers packages across 20 or more ecosystems, including npm, PyPI, Maven, Go, Cargo, RubyGems, Composer, and NuGet, so it works whether your stack is JavaScript, Python, Java, Go, Rust, Ruby, PHP, or .NET. Each package entry carries its vulnerability history, license, version list, download counts, and OpenSSF Scorecard health signal, which is a useful proxy for how well maintained a project actually is versus how well maintained it looks.
Beyond individual packages, Gold Open Source maps the wider threat landscape a developer or security engineer needs context on: a CWE index cross-referenced to the OWASP Top 10, MITRE ATT&CK matrices for enterprise, mobile, and industrial control systems, and a running reference of known malicious packages so you can check whether something in your lockfile has already been flagged as a supply-chain incident. As software supply chains have expanded past traditional code, the directory has expanded with them: it also indexes AI models pulled from Hugging Face, MCP servers from the MCP registry, agent skills, and even chip manufacturers, reflecting how much of what a modern engineering team depends on now sits outside a package.json.
The SGZ advantage: zero-days before the CVE exists
One entry deserves its own paragraph. Gold Open Source publishes SGZ advisories, zero-day vulnerabilities discovered by Safeguard's own research team and disclosed before they appear in public CVE databases. For a security team, that is the difference between finding out about a problem from your own tooling versus finding out about it from a breach report six months later. It is also the clearest sign that Gold is not just aggregating other people's threat feeds, though it credits its sources honestly: NVD, MITRE's CVE and CWE programs, OSV.dev, GHSA, CISA KEV, EPSS from FIRST.org, and OpenSSF all feed into the picture, and Safeguard's own verification and scoring sit as a layer on top of that shared foundation.
How you actually use it
Gold Open Source is built to slot into a workflow rather than require you to leave one. There is a free read-only JSON API for pulling package and vulnerability data directly (endpoints like /api/packages and /api/vulnerabilities/{cve}), a Chrome extension so you can check a package while you are browsing its repository or npm page, README status badges you can drop into your own project to show its health at a glance, a CI gate GitHub Action that fails a build on a KEV hit or any vulnerability match depending on how strict you want to be, and RSS threat feeds for teams who want the data pushed to them rather than pulled.
Why it is free
It is worth saying plainly: this is not a trial. Gold Open Source is meant to be a trust resource for the whole developer community, the kind of thing you bookmark and use whether or not you ever become a Safeguard customer. That is by design. A developer who gets a fast, accurate answer here learns to trust the data behind it, and that trust is worth more to a security company than a locked demo ever could be.
Where it leads, if you want more
Looking a package up is one thing. Never shipping a vulnerable one in the first place is another. For teams that want to go further, that data links naturally into Gold Registry, Safeguard's collection of hardened, zero-CVE drop-in replacements built on the same intelligence this directory publishes.
If you have never checked a dependency against it, start with the one you added most recently. Visit gold.safeguard.sh and look it up. It takes less time than the coffee break you were about to take anyway.
