Free dependency scanners are useful for quick lookups and limited by design. They do not read your code, see unreported flaws, or decide what to fix first. Here are seven common beliefs about them, and which parts hold up when you check.
Myth 1: Free means it uploads your code
Fact: not necessarily. The free Gold scan page states the file is parsed in your browser and never sent to a server. Check any tool's statement and test it in your network tab.
Myth 2: A manifest scan finds everything
Fact: it finds known vulnerabilities in the packages you submit. It will miss transitive packages you did not list, unreported flaws and your own code bugs.
Myth 3: No findings means safe
Fact: no matches means no known issues at that moment. See /resources/blog/a-clean-scan-does-not-mean-your-software-is-safe.
Myth 4: The highest severity must be fixed first
Fact: FIRST says CVSS measures severity and should not be used alone to assess risk. Exposure, exploitation signals and fix availability matter. EPSS adds a 30 day exploitation estimate but, per FIRST, does not know your environment. CISA recommends using the KEV catalog as an input to prioritization.
Myth 5: Free tools have no limits
Fact: they have limits. The Gold scan checks up to 100 dependencies per run and accepts specific file types: package.json, requirements.txt and CycloneDX or SPDX SBOMs. Read the limits before you rely on one.
Myth 6: You need an account to try it
Fact: some do and some do not. The Gold scan page says no login.
Myth 7: A scan replaces a process
Fact: a scan is one input. You still need owners, deadlines, upgrade habits and a way to respond when a new CVE lands. A tool that finds problems does not fix them. Automated fixing needs review. Safeguard's remediation is off by default and starts on Manual.
How to use a free scanner well
- Decide the question first: new package, supplier file or old project.
- Scan the lockfile or resolved versions, not loose ranges.
- Open each finding and read fix status.
- Record the result with a date.
- Re-run before releases.
When you outgrow it
Frequent scans, large trees, policy needs and reachability point to a full platform. Until then, the free scan at gold.safeguard.sh/scan is a reasonable first stop.
Quick check
Are free scanners accurate?
They are only as accurate as their data and your inputs. Wrong versions give wrong answers, and newly published advisories may take time to appear.
Sources
Last reviewed: 19 October 2026.
