API & Badges

Developers

Query Gold Open Source programmatically and show your project's security status with a live README badge — free, read-only, no API key.

README badge

Embed a live Safeguard Gold status badge in any README or docs. It updates automatically as a package's security status changes.

Safeguard Gold status badge example

Markdown:

[![Safeguard Gold](https://gold.safeguard.sh/badge/npm/lodash)](https://gold.safeguard.sh/package/npm/lodash)

Pattern: /badge/<ecosystem>/<name> — e.g. /badge/pypi/requests, /badge/npm/@types/node.

CI gate — GitHub Action & CLI (coming soon)

A GitHub Action and a command-line check that fail your build when a dependency is actively exploited (CISA KEV) or known-vulnerable are built but not released yet, so there is nothing to install today. Until they ship, check a manifest in your browser with the free dependency scanner: no account, and only package names are looked up.

Don't install a package or action that claims to be Gold Scan: the docs will give the install command when it ships.

Read API

All endpoints are GET, return JSON, and are rooted at https://gold.safeguard.sh. Read-only and free.

GET/api/packages?search=lodash&ecosystem=npm

Search packages (filter by ecosystem, status; paginated).

GET/api/packages/{name}

Package detail — vulnerabilities, license, version, live download count.

GET/api/packages/{name}/vulnerabilities

The CVEs affecting a package.

GET/api/packages/stats

Corpus-wide package statistics.

GET/api/vulnerabilities?search=&severity=critical

Search CVEs by keyword, severity, or ecosystem.

GET/api/vulnerabilities/{cve}

CVE detail — CVSS, EPSS, CISA KEV status, affected/fixed versions.

Example:

curl https://gold.safeguard.sh/api/packages/lodash

The API is provided as-is for read-only use. Data is aggregated from public sources — see Credits & Data Sources. Please cache badge/API responses rather than requesting them on every page load.