Maintainers do not have a security budget, and they get asked about CVEs in their dependencies constantly. Several Safeguard tools need no account. This post covers those first, then the heavier options.
What it is
Gold at gold.safeguard.sh is a free, public directory of open source software and what is publicly known about its security. It covers packages across 20 plus ecosystems, container images, CVEs, CWEs, AI models, MCP servers and agent skills. It needs no login.
How to use it
Look at your own package page
Search your package on Gold. You will see known vulnerabilities, severity, fixed versions, license, maintainer and release details. A package shows as Gold Certified when Gold knows of no vulnerabilities in the version it indexed and the package is not deprecated. That is the whole rule. Gold does not rebuild, sign or attest packages and does not host a registry, so do not describe the badge as more than it is.
If your package page lists a vulnerability, the page shows the lowest version that clears the most advisories and a copy ready upgrade command. Use that to decide the next release.
Answer user questions fast
When an issue says "am I affected by CVE-X", point to the CVE page. It has an Am I affected check where the user enters their version and gets a verdict against the advisory's affected and fixed versions. It also shows whether the CVE is on the CISA Known Exploited Vulnerabilities list.
Check your dependencies with no install
The free scan at gold.safeguard.sh/scan runs in the browser, uploads nothing, needs no login and accepts package.json, requirements.txt, and CycloneDX or SPDX SBOMs, up to 100 dependencies per scan.
Gate pull requests for free
The Gold docs describe a command line scanner, @safeguard-sh/gold-scan, published on registry.safeguard.sh. Point the scope at that registry in .npmrc:
@safeguard-sh:registry=https://registry.safeguard.sh/npm/
Then run it:
npx @safeguard-sh/gold-scan
npx @safeguard-sh/gold-scan . --fail-on vuln
By default it fails on actively exploited vulnerabilities, and --fail-on vuln fails on any known CVE. It fails open if the API is unreachable, so a Gold outage never blocks a build. Only dependency names are sent to the public read API. Be careful with the name: the docs warn never to install @safeguard/gold-scan from the public registry, because that scope belongs to someone else. The docs also say the GitHub Action for this is not published yet, so do not write a workflow that uses it.
Scan locally before a release
If you want a fuller scan, the Safeguard CLI builds an SBOM and matches it against vulnerability databases on your machine:
curl -fsSL https://cli.safeguard.sh/install | bash
safeguard scan --dir .
safeguard detect --detect secrets --format sarif --output detect.sarif
The first command installs, the second scans the project and the third looks for committed secrets. Results are written under ./output. The scan exits 0 when it ran, whatever it found, so read the files.
In the editor and browser
The Safeguard extension for VS Code, Cursor and JetBrains flags vulnerable dependencies while you work, and in VS Code and Cursor it checks new dependency names for typosquats. The Gold Open Source Chrome extension does package lookups without leaving the page.
Try it yourself
Search your most used package on Gold. Open its worst CVE, enter the version your latest release depends on, and read the verdict. Then run the free scan on your manifest and compare.
Click through it at your own pace, or open it full screen.
Quick check
Does Gold Certified mean Safeguard rebuilt or signed the package?
No. It means no known vulnerabilities in the indexed version and the package is not deprecated.
What does the Gold scan CLI do if the API is unreachable?
It fails open, so the build is not blocked.
Is the Gold scan GitHub Action published?
Not yet, per the docs. Use the command line form.
