Gold
Safeguard Gold, the public open-source security intelligence site at gold.safeguard.sh, and requesting Gold versions of vulnerable packages from Open Source Manager.
Gold
Safeguard Gold is Safeguard's public open-source security intelligence site, at gold.safeguard.sh. It is free and needs no account. Search a package, container image or CVE to see what is known about it: its known vulnerabilities with severity and fixed versions, whether a CVE is actively exploited (on the CISA Known Exploited Vulnerabilities list), and its license, maintainer and release details. The full tour is on Gold Open Source.
What "Gold Certified" means
A package or image shows as Gold Certified when Gold knows of no vulnerabilities in the version it indexed and the package is not deprecated. That is the whole rule. It describes what is publicly known about the upstream release; Gold does not rebuild, sign or attest packages, and it does not host a package or image registry.
Fixes come from the upstream project's own releases: each package page with known vulnerabilities shows the version that clears them where one exists, and each CVE page has an Am I affected? check for the version you run.
Requesting a Gold version in Safeguard
In Open Source Manager › Inventory, you can ask the Safeguard team to source a Gold version of a vulnerable package:
- Open Open Source Manager › Inventory.
- For one package, select Request Gold on its row. Safeguard confirms with Gold Request Submitted, and the row then shows Gold Requested (the marker is kept in your browser).
- For every vulnerable package at once, select Source Gold above the table, review the packages and the risks listed, then select Submit Request. Request Premium Gold works the same way for Premium Gold versions.
Each request reaches the Safeguard team as a task to source a Gold version for that package. Request Gold, Source Gold and Request Premium Gold appear only if your plan includes them; ask your Safeguard administrator if you don't see them.
Gold from your AI assistant
The Safeguard MCP server can search Gold and read a package's known vulnerabilities for an assistant such as Claude or ChatGPT, once your administrator switches those tools on. See MCP.
Related
- Gold Open Source: everything gold.safeguard.sh covers, its browser extension and its data sources.
- Open Source Manager: where Request Gold lives.
- Software composition analysis: how Safeguard finds vulnerable packages in your own projects.
Self-Healing Containers
Automatically rebuild and redeploy container images to patch new CVEs — without waiting for the next feature release.
Gold Open Source
Safeguard's free, public directory of open-source software and what is known about its security: packages, container images, CVEs, CWEs, the MITRE ATT&CK framework, AI models, MCP servers, agent skills and chip manufacturers, at gold.safeguard.sh and as a Chrome extension.