Free options cover a lot: dependency alerts from your code host, an open source scanner backed by the OSV database, OpenSSF project scorecards, and package provenance checks. They stop at prioritization, evidence, cross ecosystem coverage and support. Use them to start, then measure the gaps before you rely on them.
Which free options are worth using?
Dependency alerts from your code host. The documentation for one major code host's alerts says they flag vulnerable dependencies, show severity and a fixed version when one exists, and are tied to the host's own advisory database. They scan the default branch and re-alert when new advisories land or the dependency graph changes.
An open source scanner on the OSV database. OSV-Scanner is described by its project as an officially supported frontend to the OSV database. It links a project's dependencies to the vulnerabilities affecting them, and runs in a terminal or in CI.
Project health scoring. The OpenSSF Scorecard assesses security heuristics for open source projects, with checks such as branch protection, code review, pinned dependencies and whether a project is maintained, each scored 0 to 10. It helps you judge a dependency before adopting it.
Package provenance. For npm, provenance links a package to its source and build instructions, and npm audit signatures reports verified registry signatures and attestations.
A free browser scan. Gold, from Safeguard, offers a free in-browser scan at gold.safeguard.sh/scan covering up to 100 dependencies.
Where do they stop?
Each source states its own limits, and some are useful to know.
- Alert coverage. The code host documentation says alerts cannot catch every security issue, only advisories the host has reviewed trigger alerts, new vulnerabilities may take time to arrive in the database, archived repositories are not scanned, and alerts for CI workflow actions only cover actions pinned by semantic version, not SHA.
- Heuristics, not guarantees. Scorecard says its checks are heuristics with possible false positives and negatives, that the aggregate score does not show which specific behaviors are present, and that scores change as checks change. Its CLI supports macOS and Linux, and Windows may have issues.
- Provenance is opt in. Only publishers who enable it generate it. Absence does not prove harm and presence does not prove safety.
- Scanner scope. Free scanners tell you what is vulnerable. They do not tell you what is reachable in your code, and they do not decide your priorities.
What do free options usually leave out?
- Prioritization. A flat list of hundreds of findings.
- Reachability. Whether your code calls the vulnerable path.
- Evidence. A dated record an auditor or customer can read.
- Policy and gating. Rules that block a risky merge, with exceptions and expiry.
- Inventory across ecosystems. One view of repos, containers and builds.
- Support and accountability. Someone to call when a scan fails.
How should you choose?
- Write down what you must be able to answer: what do we run, what is exploitable, what did we do about it.
- Start with the free tools and run them for a month.
- Count the questions you could not answer. That list is your buying case.
- If you pay, test a paid tool on a repository you know well and compare its findings to the free ones.
- Check exit terms: can you export your data in open formats?
- Do not drop the free tools just because you bought another. Overlap can catch what one misses.
When does a platform make sense?
When the gap list above costs more engineering time than a subscription, or when customers and auditors ask for evidence you cannot produce by hand. Safeguard is one such option, with reachability, compliance automation, an SBOM generating CLI and a free scan to try first. Compare it, and others, against your own question list.
Quick check
Are free tools enough for a small team?
Often, at first. They tell you what is vulnerable. The pain starts when you need priorities, evidence for customers, or coverage across several ecosystems.
Does a good Scorecard result mean a package is safe?
No. Scorecard says its checks are heuristics that can produce false positives and negatives. Use it as one input.
Sources
- Code host docs: about dependency alerts
- OSV-Scanner documentation
- OpenSSF Scorecard
- npm docs: generating provenance statements
Last reviewed: 18 October 2026.
