It can be safe, but only after you check three things: where the file is processed, what the file reveals, and what your client agreement allows. A manifest lists package names and versions, not source code, yet it still describes a client's stack. Read the tool's data statement before you paste.
What a manifest reveals
A package.json or requirements.txt holds dependency names, version ranges and sometimes private package names, internal registry URLs or project names. An SBOM can go further and list every component, hashes and supplier details. None of this is source code. All of it helps an attacker plan if it leaks, and some of it may be confidential under contract.
Where does the file go?
This is the question that matters most. Some online tools upload your file to a server. Others process it locally in the page. The free Gold scan page states that files are parsed in your browser and never sent to a server, and that no login is needed. That statement is the tool's own claim, so you can verify it for yourself.
How to check a browser only claim
- Open your browser developer tools and the Network tab.
- Paste a harmless sample file and run the scan.
- Watch for outgoing requests that carry your file contents.
- Note that lookups against a corpus can still send package names. Decide whether names alone are acceptable for your client.
If you are unsure, test with the built in sample or with a file where you replaced real names.
Redaction options
Remove private package names and internal registry URLs from a copy. Keep public packages with their versions, since that is what the lookup needs. Do not edit the original. Keep a note of what you removed so the results can be reconciled.
Check the contract
Many client agreements restrict sharing project details with third parties. A browser only tool arguably shares nothing, but your client may still expect approval for any tool that touches their files. Ask once and keep the answer.
Compare with the alternative
Giving a scanner repository access is a bigger disclosure than a manifest. For a fast first look, a local parse is the lighter option. For ongoing work, use an approved platform under a proper agreement.
A short decision rule
- Public project: scan freely.
- Private project, contract silent: scan a redacted copy and note it.
- Private project, contract restrictive: ask first.
- Regulated data environment: use only approved tools.
Safeguard's free scan at gold.safeguard.sh/scan is built around that browser only model, and the Safeguard platform covers the approved, continuous case.
Quick check
Does a manifest contain secrets?
It should not, but private registry URLs with tokens occasionally slip in. Search the file for tokens before pasting anywhere.
Is browser parsing the same as private?
It keeps the file off the tool's server, per the tool's statement. Package lookups and browser extensions can still see page content, so test it.
Sources
Last reviewed: 19 October 2026.
