How do I run a free dependency scan on my project?

To run a free dependency scan, open the Safeguard Gold scan page, paste your dependency file (such as package.json or requirements.txt) or upload an SBOM, and start the scan. You get a list of packages with known vulnerabilities. It needs no login, and the file is read in your browser.

TL;DR

• You need one file: a dependency list or an SBOM (a software bill of materials, explained below).
• The free scan checks up to 100 dependencies against the Gold corpus, which is Safeguard's database of known open source vulnerabilities.
• It runs in your browser. You do not sign in.
• The result is a starting list, not a verdict. Read it, pick the worst items, and fix those first.

Definition: A dependency scan reads the list of outside packages your project uses and compares each name and version to a database of known vulnerabilities. It does not run your code and it does not read your source files.

What is a dependency scan, and why does it matter?

Most modern software is built from parts other people wrote. When you add one package, that package often pulls in a dozen more. Together these are your dependencies. You did not write them, but you ship them.

Now and then, someone finds a flaw in one of those parts. The flaw gets a public ID called a CVE (short for Common Vulnerabilities and Exposures). A dependency scan is the quick check that answers one question: "Do I use a part that has a known CVE?"

Think of it like checking a recall list. A carmaker does not know which of your parts you replaced last year, but you can read the recall list against your own receipts. The scan does the matching for you.

If you want a deeper look at the idea, see our post on the dependency scanner and on direct versus transitive dependencies. A direct dependency is one you chose. A transitive dependency is one that came along with it.

What do I need before I start?

You need one of these:

An SBOM is a software bill of materials. It is an ingredient list for software. CycloneDX and SPDX are two common file formats for that list. Your build tool may be able to export one. A supplier may also have sent you one.

The Gold scan page describes its input this way: you paste or upload a dependency manifest, or a CycloneDX or SPDX SBOM. It also says it checks up to 100 dependencies. If your project has more than that, use the scan as a first look and move to the command line tool or the platform later. We cover those in other posts.

How do I run the scan step by step?

Here is the path the Gold scan page shows.

1. Open https://gold.safeguard.sh/scan in your browser.
2. Pick how to give it your data. You can choose Scan dependencies and paste text, choose Upload a file, or choose Try a sample if you only want to see how it looks.
3. Paste the contents of your manifest, or pick your SBOM file.
4. Start the scan.
5. Read the list of packages that carry known vulnerabilities.
6. Write down the packages you will look at first (the next section helps with this).

The page states that the file is parsed in your browser and never sent to a server. It also says there is no login. That makes it a safe place to start if you are not ready to connect a repository to any tool.

If you are not sure which file to use, begin with the sample. It takes a few seconds, and it shows what a result looks like before you use real data.

How do I read the results?

Each flagged package shows a known vulnerability. Do not panic at the count. A long list is normal for a first scan, and many items are less urgent than they look.

Use this simple order:

1. Look for the fixed version. If the package has a newer version that removes the problem, upgrading is often the whole fix.
2. Look at severity. A critical or high item deserves attention before a low one.
3. Ask if your code uses the risky part. A flaw in a function you never call is less urgent than one in a function you call on every request. This idea is called reachability. Our post on reachability and ROI goes deeper.
4. Check if attackers are using it. Some flaws are known to be exploited in the wild. Our CVSS, EPSS and KEV FAQ explains those scores in plain words.

A free browser scan checks names and versions. It cannot tell you whether your code reaches the risky part. For that you need a tool that looks at your code, such as the Safeguard platform.

What does a worked example look like?

Here is an invented example. The numbers are made up to show the thinking, not to describe a real project.

Say you paste a package.json with 40 dependencies. The scan reports:

Your plan:

1. Upgrade the two packages that have a fixed version. Run your tests. Ship.
2. For the third, read the advisory. If the flaw only matters when a feature you do not use is turned on, note that in your tracker and set a date to look again.
3. Look at the six lower items at your next regular upgrade day.

You spent your effort on the right three items first. The numbers here are only a model. Your own results will differ.

What are the limits of a free scan?

Be clear about what you get.

• It is a snapshot. New vulnerabilities are published every day. A scan from today does not cover next month.
• It covers up to 100 dependencies. Larger projects need another route.
• It matches names and versions. It does not run your program or confirm that a flaw can be triggered.
• It depends on what you paste. A manifest lists what you asked for. It may not list every indirect package. An SBOM is often fuller.

None of this makes the scan less useful. It is a fast way to learn whether you have a problem worth your time.

How can Safeguard help after the first scan?

The free scan at gold.safeguard.sh/scan is the easiest first step. When you want more, Safeguard offers these generally available capabilities:

• SBOM and dependency scanning for whole repositories, kept up to date as code changes.
• Reachability analysis, which checks whether your code can reach a vulnerable function, so you can fix the real risks first.
• Autonomous remediation with fix pull requests. This is off by default, and every category starts on Manual, so nothing changes until your team turns it on.
• Policies and gates, which can stop a risky change before it merges.

You can also use the Safeguard CLI from your terminal. It scans a folder on your own machine and sends only the results to the platform. Its built-in assistant can also write code, for example to apply a fix. You review each change before you accept it.

If you prefer to look before you commit, try the demo below.

Try it yourself

Click through it at your own pace, or open it full screen.

Click through the steps and look for how direct and transitive packages are listed together. That is the list you want your scan to cover.

Quick check

Sources

• Safeguard Gold, Free Dependency Scan
• Safeguard product demos
• SCA dependency inventory demo
• Safeguard CLI documentation

Last reviewed: 19 October 2026.