You can run a free dependency scan at gold.safeguard.sh/scan without an account. Paste a package.json or requirements.txt, or upload a CycloneDX or SPDX SBOM, and it checks up to 100 dependencies against the Gold corpus. Per the page, files are parsed in your browser and nothing leaves it.
What the page says it accepts
When we fetched the page on 19 October 2026 it listed:
- Manifests: package.json and requirements.txt.
- SBOMs: CycloneDX and SPDX files.
- Inputs: paste text, upload a file, or run a built in sample.
- Limit: up to 100 dependencies.
- Account: none, "free, no login".
It does not describe the result format in detail, so run the built in sample first to see what you get.
A quick way to try it
- Open the page in any browser.
- Choose the sample to see the output with no risk.
- Paste your own manifest. Remove anything private you do not want on screen, such as internal package names.
- Read the list of packages flagged with known vulnerabilities.
- For each, check whether a patched version exists and plan the bump.
We have not confirmed how the page lays out on a small phone screen, so if you want to use it from a phone, test it with the sample first. For anything serious, a laptop makes the results easier to read.
What a manifest scan cannot tell you
A manifest lists what you asked for. It misses what you actually shipped.
- Transitive dependencies may be absent from a package.json. A lockfile or a generated SBOM captures the full tree, so prefer an SBOM when you have one.
- Reachability is not part of a simple manifest check. Knowing a package has a known flaw does not tell you whether your code calls the vulnerable function.
- Hundred dependency limit. A large application will exceed it. Scan a representative slice or use a full scan route for the rest.
Where to go next
If the free scan shows something that matters, the next step is a proper inventory: generate an SBOM in your build, scan on every pull request, and use reachability to rank the results. The Safeguard CLI, IDE extensions and platform cover those. The free page is the front door, not the whole house.
Privacy note
The page states that parsing happens in the browser. That is the vendor's statement, so if you handle sensitive manifests, check the network tab in your browser's developer tools while you run a scan. Seeing no upload request is stronger evidence than any claim.
Quick check
Do I need to sign up to use the free scan?
No. The page says free, no login.
Why prefer an SBOM over a package.json?
An SBOM usually includes transitive dependencies, which is where much hidden risk lives.
Sources
Last reviewed: 19 October 2026.
