The Marketplace page is a catalogue with several kinds of items on one shelf. Here they are, separated.
What it is
The page describes a catalogue of Safeguard fixed Gold components, in early access, across npm, PyPI, Maven, Docker, RubyGems, NuGet, Cargo and Go modules. Each component is checked before certification, and the page lists vulnerability scanning, malware detection, license checks with CycloneDX and SPDX SBOMs, and provenance validation. A custom hardened version can be requested through Griffin AI.
Beyond components it lists:
- Connectors for Jira, ServiceNow, Slack, Teams, PagerDuty, Splunk, Datadog and Snowflake.
- Verified SBOM bundles for LAMP, MEAN, Django, Spring and Rails.
- Compliance packs for SOC 2, ISO 27001, FedRAMP, DPDP, NIS2 and DORA, with baseline policies, control mappings and report templates you can customize.
- Community scanners and enrichments that Safeguard reviews and signs, and customer built workflows shared with the author's consent.
How to use it
The page describes this install flow: browse, preview the manifest and permissions, install, map fields and policy, test in a sandbox, enable in production and watch the audit log. Read the permissions step carefully for any third party plugin.
What to verify
A compliance pack is a starting set of policies and mappings, not evidence that you meet a framework. The Gold items are early access and the catalogue is described as growing, so check current coverage. The page makes vendor claims of zero critical or high vulnerabilities that you should test on the package you intend to use.
Quick check
Is a compliance pack proof of compliance?
No. It is baseline policies, control mappings and report templates to customize.
