Gold Open Source
Safeguard's free, public directory of open-source software and what is known about its security: packages, container images, CVEs, CWEs, the MITRE ATT&CK framework, AI models, MCP servers, agent skills and chip manufacturers, at gold.safeguard.sh and as a Chrome extension.
Gold Open Source
Gold Open Source is Safeguard's free, no-login public directory of open-source software and what is publicly known about its security, available at gold.safeguard.sh. Anyone can look up a component's known vulnerabilities without an account.
What "Gold Certified" means
A component shows as Gold Certified when Gold knows of no vulnerabilities in the version it indexed and the component is not deprecated. That is the whole rule: it describes what is publicly known about the upstream release. Gold does not rebuild, sign or attest components, and the labels on a component's verification panel follow from this rule and from whether the component links a source repository; they are not separate scans.
Each component page shows the evidence behind its status: the known vulnerabilities with their advisories, the license and the release details.
What it covers
Gold Open Source spans the modern software (and AI) supply chain:
| Section | What's in it |
|---|---|
| Packages | Verified open-source packages across 20+ ecosystems (npm, PyPI, Maven, Go, Cargo, and more) with vulnerability counts, license, and version data. |
| Container Images | Docker images in the index, with their known vulnerabilities and license. |
| Vulnerabilities (CVEs) | A real-time CVE database searchable by package, severity or ecosystem, with CVSS, affected and fixed versions, and remediation. |
| CWE Index | Every Common Weakness Enumeration class with related CVEs. |
| MITRE ATT&CK® | Tactics, techniques and sub-techniques, mitigations, threat-actor groups, malware/tools, and campaigns across the Enterprise, Mobile, and ICS matrices. |
| AI Models | Open-weight models sourced from the Hugging Face Hub (with live download and star counts) plus notable frontier models. |
| MCP Servers | Thousands of Model Context Protocol servers from the official registry. |
| Agent Skills | Official Anthropic Agent Skills and notable community skills. |
| Chip Manufacturers | Semiconductor companies from fabless designers to foundries and equipment makers. |
Chrome extension
Gold Open Source is available as a Chrome extension so lookups happen without leaving the browser. Install it from the Chrome Web Store.
Remediation guidance
Every CVE page includes an "Am I affected?" check: enter the version you're running and get an immediate verdict against the advisory's affected and fixed versions. Every package page with known vulnerabilities shows a recommended safe version: the lowest version that clears the most advisories, with a copy-ready upgrade command for your ecosystem.
CI gate: GitHub Action and CLI (planned)
Not yet published. The Gold Scan action and its command-line form are built but not yet released: safeguard-sh/gold-scan-action is not on the GitHub Marketplace and there is no Gold Scan package on npm, so the workflow below does not run yet. It shows how it will work once it ships.
Gate your pipeline on Gold intelligence for free: no account, no API key, and your source never leaves the runner (only dependency names are sent to the public read API). Add .github/workflows/gold-scan.yml:
name: Gold Scan
on: [push, pull_request]
jobs:
gold-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: safeguard-sh/gold-scan-action@v1
with:
fail-on: kev # kev = actively exploited only | vuln = any known CVE | none = report onlyA command-line form for pre-commit hooks, GitLab CI, Jenkins or a local run is planned for the same release. Until this page gives its install command, there is no Safeguard package to install: don't install a package that claims to be Gold Scan.
It discovers npm, PyPI, crates.io, Go, RubyGems, and Packagist manifests, flags dependencies that are actively exploited (CISA KEV) or known-vulnerable, and writes a summary to the run. It fails open if the API is unreachable, so a Gold outage never blocks your build. See Developers for the full API and README badge.
Data sources
Gold Open Source aggregates, normalizes, and enriches public data. Attribution for every source is listed on the Credits page: NVD (NIST), the CVE and CWE programs (MITRE), OSV.dev, GitHub Security Advisories, OWASP, the Hugging Face Hub, the MCP registry, and the open-source package and container registries.
MITRE ATT&CK® is a registered trademark of The MITRE Corporation.
Gold
Safeguard Gold, the public open-source security intelligence site at gold.safeguard.sh, and requesting Gold versions of vulnerable packages from Open Source Manager.
AI-BOM & Model Security
Track, govern, and secure AI models — model cards, weight provenance, fine-tune lineage, and training-data risk.