If you run a small software company, you do not have a security team. You have a customer who asked a question, a few repositories, and limited time. This is a modest first month plan using what Safeguard documents today.
What it is
The goal is not to buy everything. It is to get an honest picture of your dependencies, fix the few things that matter, and have a credible page to point customers to.
How to use it
Week 1: look before you sign up
Go to gold.safeguard.sh/scan. Drop in a package.json, requirements.txt, or a CycloneDX or SPDX SBOM. It runs in your browser, the file never leaves your machine, there is no login, and it handles up to 100 dependencies. You get a first picture in minutes.
Use gold.safeguard.sh to look up a package before you adopt it. The directory lists packages, CVEs with CISA KEV status, malicious packages and MCP servers. A package shows as Gold Certified only when Gold knows of no vulnerabilities in the indexed version and the package is not deprecated. That describes public knowledge, not a rebuild or signature.
Week 2: create an account and scan properly
Sign in at app.safeguard.sh. The app is chat first, so ask questions in plain language. Connect a repository, or scan privately with the CLI:
curl -fsSL https://cli.safeguard.sh/install | bash
safeguard
Type /login, then /scan .. Source stays on your machine. Only the SBOM and findings are uploaded. If you cannot give a cloud service access to a private repo, this is the route.
Week 3: fix in the editor
Install the Safeguard extension in VS Code, Cursor or a JetBrains IDE so new dependencies are checked as you add them. In VS Code and Cursor the inline Package Firewall check flags typosquats and known malicious names before install. This is cheaper than finding them later.
Week 4: answer the customer
When a buyer asks for security documentation, a public page saves email threads. If the Trust Center is switched on for your workspace, you set a slug, choose the frameworks and policies to show, and publish deliberately. Keep it true: the docs recommend stating only what is real today, and saying no to a data category is a stronger answer than leaving it out.
Remember that a readiness score is not an audit and a framework page is not a certification. Do not publish wording that suggests otherwise.
Settings worth knowing
Safeguard can run as Full AI, Zero AI, or with a model you bring. If your customers restrict where code or data goes, Zero AI and local runner mode are worth raising early. You can also connect an assistant you already use, such as Claude or ChatGPT, to mcp.safeguard.sh. This is a connection through MCP with your own model, not a pass through of any subscription.
Try it yourself
Run your main repository's manifest through the free scan today. Write down the three findings you will fix first and why. Then repeat the scan after the fixes and keep both results.
Click through it at your own pace, or open it full screen.
Quick check
Does the free scan upload your manifest?
No. It runs in the browser and the file never leaves your machine.
How many dependencies does one free scan cover?
Up to 100.
Is a Trust Center framework status the same as an audit report?
No. Frameworks that need an auditor must show the certification or report, not a self declared status.
