A free scan tells you which known vulnerabilities match the packages in the code you gave it, at that moment. It cannot tell you about unknown flaws, mistakes in your own code, how your system is configured at runtime, or what a finding would cost you. Read it as a starting map.
What a scan sees
Your dependency list, matched against public advisory data. That is valuable, since known vulnerable packages are a common and avoidable cause of incidents.
What it does not see
Unknown vulnerabilities. If no advisory exists, a database match cannot flag it.
Your own code. Injection, broken access control and logic flaws live in code you wrote, which dependency matching does not read.
Runtime and configuration. Exposed storage, weak settings, open ports and secrets in environment variables sit outside a repository scan.
Business context. The scan does not know that one service holds payment data and another is a demo.
Time. Tomorrow's advisory is not in today's report.
How to read the result sensibly
- Sort by fix available first. Those are the quick wins.
- Look at packages in internet facing services before internal tools.
- Check whether severity ratings match how you use the package.
- Treat zero findings with suspicion. Confirm the scanner found your lockfile.
What to do next
Use the scan to decide your next step, not to close the question. If the list is short and fixable, fix it and add a rescan. If it is long, you need prioritisation. If the result shows gaps in your own code, add other test types.
Why this honesty matters
A comforting but incomplete report is a risk in itself. People stop looking. Keep the scan in context and record what it did not cover.
Questions to ask yourself after any scan
Did the scan cover all repositories, or only the one I picked? Did it include test and build dependencies, and should it? Which services were not scanned at all? Writing these answers next to the report turns a one off snapshot into a record that says what was covered. It also keeps the next person from assuming more than was done.
Where Safeguard fits
The Safeguard free scan covers dependency findings. The platform adds reachability analysis, policies, SBOM handling and fix pull requests that stay off until you enable them.
Quick check
If my scan is clean, am I secure?
No. It means no known dependency issue matched today. Other risks remain.
Last reviewed: 19 October 2026.
