DUBLIN, Calif., October 15, 2026: Safeguard, the AI-native software supply chain security platform, today introduced Gold Live, a tier of its Gold sourcing service that keeps every version of a fixed open-source component clean over time, and previewed Gold Zero-Day, which is coming soon. The first Gold builds are now live on Safeguard's private registry, registry.safeguard.sh, in early access.
With Safeguard Gold, customers pull Safeguard-fixed open-source packages and container images from registry.safeguard.sh instead of remediating vulnerabilities themselves. Safeguard pins the exact upstream release, backports the upstream fix, runs the project's own tests and keeps only its patch on top of the upstream source. Where a fixed package depends on other vulnerable packages, the whole dependency tree can be built as Gold. Gold builds carry their own versions, such as 1.2.3-sg.1 (1.2.3+sg.1 on PyPI), so they are never mistaken for upstream releases.
First Gold builds live
The registry is live and authenticated. The first Gold builds published are minimist 1.2.5-sg.1 on npm and pyyaml 5.3+sg.1 on PyPI. A live end-to-end test passed using real npm, pnpm and Yarn clients and pip, uv and Poetry.
registry.safeguard.sh supports npm, PyPI, Maven and Gradle, NuGet, Composer, RubyGems, Go, Cargo, Helm, Docker and OCI images, and OS packages (apt, dnf and apk) for configuration and pass-through. Gold builds exist for npm and PyPI today. Support for the other ecosystems is built, and Gold builds for them are rolling out. Anything not in Gold passes through to the public source via Safeguard's cache, so teams keep a single source configuration.
Every Gold build carries:
- No known vulnerabilities at last scan, and no known malware (checked with ClamAV)
- A reproducible build, built twice with byte-identical results
- A CycloneDX software bill of materials (SBOM)
- SLSA provenance, at Build Level 2 today
- A VEX document stating which vulnerabilities the build fixes
- A signature made with Safeguard's own key, held in a cloud key management service
Customers verify each build with cosign against Safeguard's published public key. Gold does not use a public transparency log. The upstream licence and notice files are preserved in every build.
Three tiers, one security bar
All three Gold tiers meet the same security bar at build time. They differ in coverage over time.
- Gold keeps the latest version of each package line clean. Older versions are clean as of their build date.
- Gold Live rescans every version and rebuilds it when a new issue is found. Customers get notices, signed webhooks, automatic upgrade pull requests and CI triggers, so a rebuild reaches their builds without silently changing what a lockfile installs.
- Gold Zero-Day, coming soon, will add early fixes for Zero Days found by Safeguard's own models on top of Gold Live.
Safeguard publishes its fix-time and uptime targets for each tier. They are targets, not guarantees. Every tier is to be notified of a new issue within 24 hours, and malware is to be pulled within 24 hours.
For a critical vulnerability, the target is 7 days for the latest version under Gold and 72 hours under Gold Live. High-severity targets are 14 days and 7 days. Medium- and low-severity targets are 30 days and 14 days. A request for a new package targets 10 or 5 business days. Monthly registry uptime targets are 99.5% for Gold and 99.9% for Gold Live. Targets for Gold Zero-Day will be confirmed at launch.
"Most teams don't need another list of vulnerable packages. They need the package fixed, and they need to be able to check the fix for themselves," said Hritik Kumar Sharma, founder and CEO of Safeguard. "With Gold we do the backport once, run the project's own tests, sign the build and publish the evidence, so every customer on that version can pull it and verify it. Gold Live keeps doing that for every version a customer runs, not only the latest one. Our targets today are in days and hours. The goal is to take time-to-fix down to minutes, and eventually to seconds and milliseconds. We aren't there yet, and we'll be plain about that until we are."
Safeguard has published a four-part educational series alongside this announcement, covering why self-patching dependencies doesn't scale, how coverage over time works, and runtime guardrails inside applications. It starts at safeguard.sh/resources/blog/why-patching-dependencies-yourself-doesnt-scale.
Availability
Gold and Gold Live are available in early access now. Gold Zero-Day is coming soon. Pricing is available on request. To request access, book a call at safeguard.sh/book-a-call or email sales@safeguard.sh.
About Safeguard
Safeguard is the AI-native software supply chain security platform. It finds risk across code, dependencies, containers and AI, and fixes it autonomously with tested pull requests. Learn more at safeguard.sh.
Media contact: press@safeguard.sh
