Safeguard Gold is a public directory of open-source software and what is publicly known about its security. It is free and needs no account. Search a package, container image or CVE and you see known vulnerabilities, severity, fixed versions, whether a CVE is on the CISA Known Exploited Vulnerabilities list, and license and maintainer details.
What is in it
The docs list these sections:
| Section | Contents |
|---|---|
| Packages | Open-source packages across 20 plus ecosystems, with vulnerability counts, license and version data |
| Container images | Images in the index, with known vulnerabilities and license |
| Vulnerabilities | A CVE database searchable by package, severity or ecosystem, with CVSS, affected and fixed versions |
| CWE index | Weakness classes with related CVEs |
| MITRE ATT&CK | Tactics, techniques, mitigations, groups, malware and campaigns |
| AI models | Open-weight models from the Hugging Face Hub plus notable frontier models |
| MCP servers | Servers from the official registry |
| Agent skills | Official Anthropic skills and notable community skills |
| Chip manufacturers | Semiconductor companies |
The site navigation also has pages for the actively exploited (KEV) list, malicious packages, trending threats, RSS feeds and a supply chain report.
What "Gold Certified" means
The docs give the whole rule. A package shows as Gold Certified when Gold knows of no vulnerabilities in the version it indexed and the package is not deprecated. That describes what is publicly known about the upstream release. Gold does not rebuild, sign or attest packages, and it does not host a package registry.
Where the data comes from
Gold aggregates and normalizes public data: NVD, the CVE and CWE programs, OSV.dev, GitHub Security Advisories, OWASP, the Hugging Face Hub, the MCP registry and the open-source package and container registries. A credits page lists attribution.
How to use it
Check a CVE against your version. Every CVE page has an Am I affected? check. Enter the version you run and get a verdict against the advisory's affected and fixed versions.
Pick a safe version. A package page with known vulnerabilities shows a recommended safe version, the lowest version that clears the most advisories, with a copy-ready upgrade command.
Scan a dependency file. gold.safeguard.sh/scan runs in your browser, with no login. It takes package.json, requirements.txt, or a CycloneDX or SPDX SBOM, up to 100 dependencies per scan, and the file never leaves your machine.
Look up in the browser. The Gold Open Source Chrome extension does package lookups without leaving the page.
Ask from an assistant. The Safeguard MCP server can search Gold for an assistant such as Claude or ChatGPT once an administrator switches those tools on.
Request a Gold version inside Safeguard. In Open Source Manager, Inventory, select Request Gold on a package row, or Source Gold above the table for every vulnerable package. These options appear only if your plan includes them, and each request reaches the Safeguard team as a task.
A note on the CI gate
The Gold docs describe a command-line scanner and a GitHub Action. The command-line form is published on registry.safeguard.sh. The GitHub Action is documented as not yet published, so do not depend on it. The scanner is documented to fail open if the API is unreachable, so a Gold outage does not block a build.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does Gold Certified mean Safeguard signed or rebuilt the package?
No. It means no known vulnerabilities in the indexed version and the package is not deprecated. Gold does not rebuild, sign or attest packages.
