The free scan at gold.safeguard.sh/scan checks a package.json, requirements.txt, CycloneDX SBOM or SPDX SBOM for known vulnerabilities, with no login. You paste or upload a file, or try a sample. Here is how to use it well and how to read the output with care.
What the page says
The scan checks dependency manifests and SBOMs against the Gold corpus. Accepted inputs named on the page are package.json, requirements.txt, and CycloneDX or SPDX SBOMs. It checks up to 100 dependencies, and it says files are parsed in your browser and never sent to a server.
Two things follow. First, a large project may exceed 100 dependencies, so the result may not cover the whole tree. Second, a manifest lists what you asked for, and a lockfile or SBOM lists what was actually installed, so the more complete input is usually the SBOM.
Prepare the input
Use a copy of the file, not your working file. Remove anything secret, since manifests can contain private registry addresses. If you have an SBOM from your build, prefer it, because it includes transitive packages. The post on CycloneDX versus SPDX explains the formats.
Read the results
For each finding, look at four things.
- The package and the installed version. Make sure the version is the one you actually ship.
- The affected range. Advisories describe where a flaw starts and where it is fixed. See OSV version ranges.
- Whether a fixed version exists, and how large the jump is.
- Whether the flaw is known to be exploited. CISA's catalog lists those.
Decide what to do
Sort into three piles. Fix now: known exploited or clearly reachable. Plan: a fix exists and is low risk. Watch: no fix yet, so note it with a review date.
Do not stop at the first screen. Scan again after each change to confirm the finding is gone and nothing new appeared.
What a free scan cannot do
It cannot see your code, so it cannot say whether a flaw is reachable. It cannot track a project over time. It does not replace a gate in your pipeline. It is a quick, private first look.
Next steps
If the first look finds things worth fixing, move to a repeatable process: a scan in your build, a gate on pull requests, and a regular review. Try the walkthrough below to see what an inventory looks like.
Where Safeguard fits
Beyond the free scan, Safeguard provides SBOM and dependency scanning, reachability analysis, policies and gates, and a CLI and Desktop app for repeat use.
Click through it at your own pace, or open it full screen.
Quick check
How many dependencies does the free scan check?
The page says up to 100.
Is my file uploaded?
The page says files are parsed in your browser and never sent to a server.
Sources
Last reviewed: 19 October 2026.
