When you ask a tool what it can read, a vague answer is useless. The useful version is a list of file names. Safeguard reads a wide range of inputs, and the docs name them. Here they are, grouped by what you would upload them for.
Package manifests and lockfiles
The file upload docs list these.
| Ecosystem | Files |
|---|---|
| Node.js | package.json, package-lock.json, yarn.lock |
| Python | requirements.txt, Pipfile, Pipfile.lock, pyproject.toml |
| Java, Maven | pom.xml |
| Java, Gradle | build.gradle, build.gradle.kts |
| .NET | csproj files, packages.config, deps.json files |
| Ruby | Gemfile, Gemfile.lock |
| PHP | composer.json, composer.lock |
| Go | go.mod, go.sum |
| Rust | Cargo.toml, Cargo.lock |
Lockfiles matter. A manifest says what you asked for. A lockfile says what you got, including indirect dependencies.
Existing SBOMs
If you already have an SBOM, you can bring it in. The docs list CycloneDX versions 1.3 through 1.6 in JSON and XML, and SPDX versions 2.2 and 2.3 in JSON, Tag-Value and RDF. Syft and Trivy JSON are converted to CycloneDX, and Grype JSON is imported as vulnerability data. The accepted extensions are json, xml, spdx and rdf, with a documented maximum file size of 100MB. The docs note that uploads currently go through the interface, and the CLI can validate and scan a local SBOM without uploading it.
Binary files
The binary docs list Windows exe, msi and dll files, Android apk and aab, iOS ipa, Java jar, war and ear, Linux ELF executables, and macOS app and dmg. Uploads can be up to 2GB. Larger files take longer to process. Encrypted sections cannot be analyzed, and custom compression may not be supported.
Security documents
CSAF 2.0 advisories and three VEX flavors are supported, all as JSON: CycloneDX VEX, OpenVEX and the CSAF VEX profile. The files must be valid JSON that follows the schema.
AI models
The AI-BOM docs describe scanning model weights for embedded executable code, and they call out Python pickle serialization in particular, because it can execute code at load time. They do not list other model formats.
Documents for compliance and questionnaires
Safeguard also works with compliance material: evidence, policies and questionnaires. The documentation pages I read do not list file types for those, so check the in product import screen for the types it accepts before you plan a bulk upload.
Free browser scan
The free scan at gold.safeguard.sh/scan accepts package.json, requirements.txt, CycloneDX and SPDX SBOMs, up to 100 dependencies. The file stays in your browser and no login is needed.
How to choose
- Have a lockfile? Upload it. It is the most accurate small input.
- Shipping a product? Upload the SBOM your build already produces.
- Received a vendor package? Upload the binary or the vendor SBOM.
- Received an advisory or a statement? Upload the CSAF or VEX file.
Quick check
Why prefer a lockfile to a manifest?
A lockfile records the exact resolved versions, including indirect dependencies.
What is the documented size limit for an SBOM upload?
100MB.
