Scan the file that lists exact resolved versions. A lockfile or SBOM beats a manifest with version ranges, because a range does not say what you actually installed. The free scan accepts package.json, requirements.txt and CycloneDX or SPDX SBOMs, so use the most precise one you have.
What each file tells you
package.json lists the dependencies you declared, often with ranges such as a caret or tilde. It does not say which exact version resolved on install, and it lists direct dependencies only.
requirements.txt can be either a loose list or a pinned freeze. If lines use exact versions, the scan is precise. If they use minimum versions, it is not.
A CycloneDX or SPDX SBOM is an inventory of components, often with exact versions and sometimes the full tree. CISA describes an SBOM as a nested inventory, a list of the ingredients that make up software.
Why ranges give weaker answers
A range allows many versions. A lookup tool must guess which one you use, or test the declared version only. Either way the answer may not match what runs in production. An exact version removes the guess.
Ranking by accuracy
- SBOM generated from the built artifact.
- Pinned requirements.txt or a lockfile converted to an SBOM.
- package.json with exact versions.
- package.json with ranges.
- Loose requirements.txt without pins.
Practical tips
For a Node project, generate an SBOM from the installed tree with your tooling of choice, and scan that. For Python, produce a pinned list from the environment you deploy. Keep the file you scan, with the date, next to the result.
Watch the 100 dependency cap
SBOMs and frozen lists get large fast. The scan checks up to 100 dependencies per run, so slice the file or use an automated scanner. See /resources/blog/free-scan-over-100-dependencies-what-to-do.
Dev versus runtime
Separate development dependencies from runtime ones when you read the results. Both matter, but a test library has a different exposure from a web framework.
Which does Safeguard use?
Safeguard's scanning reads manifests, lockfiles and SBOMs, and its SBOM tooling can produce and compare them. For a quick look at one file, use gold.safeguard.sh/scan.
Quick check
Can I paste a lockfile?
The page lists package.json, requirements.txt and CycloneDX or SPDX SBOMs as inputs. Convert a lockfile to an SBOM first, or paste the manifest.
Sources
Last reviewed: 19 October 2026.
