DUBLIN, Calif., October 15, 2026: Safeguard, the AI-native software supply chain security platform, today opened early access to Gold sourcing. With it, customers will be able to source Safeguard-fixed open-source components instead of remediating vulnerabilities themselves.
Safeguard will fix the open-source code that carries a vulnerability, rebuild the component and publish it to a private registry at registry.safeguard.sh. Customers will pull from it with the package managers they already use. Safeguard is building support for npm, PyPI, Maven and container images first. Anything not in Gold will fall back to the public source, so teams keep a single source configuration.
Gold sourcing starts with open-source packages and container images. Support for AI models, agent skills and connectors, including MCP servers, will follow.
Every Gold artifact will ship with no known vulnerabilities at last scan and no known malware. Each will also carry a software bill of materials (SBOM), signed SLSA build provenance and a VEX document stating which vulnerabilities the build fixes. Safeguard will publish its public signing key so customers can verify each build themselves.
Gold sourcing will come in three tiers. All three meet the same security bar at build time and differ in how long Safeguard keeps a build clean:
- Gold keeps the latest version of each component clean.
- Gold Live rescans every version continuously and rebuilds it when a new issue is found, with faster fix targets.
- Gold Zero-Day, coming soon, will add early fixes for Zero Days found by Safeguard's own models on top of Gold Live.
Safeguard is publishing its launch targets for fix times now. They are targets, not guarantees. Under Gold and Gold Live, customers are to be notified of a new issue within 24 hours, and malware is to be pulled within 24 hours. For a critical vulnerability, the launch target is 7 days for the latest version under Gold and 72 hours under Gold Live. High-severity targets are 14 and 7 days. Medium- and low-severity targets are 30 and 14 days. A request for a new package targets 10 or 5 business days. Monthly registry uptime targets are 99.5% for Gold and 99.9% for Gold Live. Targets for Gold Zero-Day will be confirmed at launch. Components not in Gold will be passed through from the public source.
Early-access customers will see Gold where they already work in Safeguard. In Safeguard Open Source Manager (OSM), at app.safeguard.sh/osm/inventory, the components a customer already tracks show whether a Gold build exists and which tier covers it, and a build can be requested from the same screen. Safeguard is also building Gold into compliance evidence, to support software supply chain controls in SOC2, NIST SSDF and the EU Cyber Resilience Act. That evidence supports those controls and does not satisfy them alone.
"Security teams don't need another list of vulnerable packages. They need the package fixed," said Hritik Kumar Sharma, founder and CEO of Safeguard. "With Gold sourcing, we do the backport and the verification once, and every customer running that version can pull the fixed build and check our signature for themselves. Our fix targets today are measured in days and hours. Our goal is to bring that down to minutes, and over time to seconds and milliseconds. We'll publish our measured fix times as we go, so customers can judge the progress for themselves."
Availability
Early access to Gold sourcing is open now. General availability will be announced later. Pricing is available on request. To request early access, book a call at safeguard.sh/book-a-call or email sales@safeguard.sh.
About Safeguard
Safeguard is the AI-native software supply chain security platform. It finds risk across code, dependencies, containers and AI, and fixes it autonomously with tested pull requests. Safeguard deploys as SaaS, in a private cloud, on-prem or fully air-gapped. Founded in 2024, Safeguard is headquartered in Dublin, California. Learn more at safeguard.sh.
Media contact: press@safeguard.sh
