On Safeguard's Gold directory, Gold means a component showed no known high or critical vulnerabilities at its last scan and passed checks for malware, license and provenance. It is a snapshot of known issues, not a guarantee. It cannot cover flaws nobody has reported yet, or risk that comes from how you use the package.
What the directory says Gold is
The site describes four pillars: no known vulnerabilities, no known malware, license compliance and complete provenance. A tooltip on the site puts the vulnerability part more narrowly: no known high or critical vulnerabilities at last scan. The page also says components are re-checked as new advisories are published.
Notice the qualifiers. "Known" means published in an advisory source. "At last scan" means the answer has a timestamp. Pages show a last indexed time, so look at it.
What Gold cannot tell you
Unknown flaws. Every vulnerability is unknown until someone finds and reports it. A clean result today does not predict next month.
Low and medium issues. A package can carry lower severity findings and still be Gold under the high or critical rule. Check the vulnerability count on the page.
Your usage. A vulnerable function you never call is a different risk from one on your main request path. That question is about reachability, which a directory page does not answer for your code.
Transitive dependencies. A package page lists direct dependencies. Your build may pull in more.
Reading the checklist honestly
The checklist items carry short sentences. On pages we reviewed, an item could be marked as passing while its sentence said a license was not identified in metadata. Whether that is a display choice or a data gap, the safe reading is the same: where a sentence says something is missing, go and verify it.
Provenance works the same way. A sentence saying the source repository is linked and traceable is stronger than one saying no source repository is on record.
How to use Gold in a decision
- Treat Gold as a filter, not a verdict. It helps you remove obviously bad candidates fast.
- Record the version and the last indexed time you looked at.
- Confirm license and repository yourself for anything that ships to customers.
- Re-check on a schedule, because the answer changes when advisories land.
- Run your own manifest through a scan to see the dependencies you actually have.
You can do step five with the free scan at gold.safeguard.sh/scan, and Safeguard's dependency scanning covers the continuous version of it.
Quick check
Is a non Gold package unsafe?
Not necessarily. It may have a known high or critical issue, a missing check, or simply no data yet. Open the page and read which item failed.
How fresh is a Gold result?
Check the last indexed timestamp on the package page. The site says components are re-checked as advisories are published.
Sources
Last reviewed: 19 October 2026.
