No known high or critical vulnerabilities at last scan, malware-free, license-compliant, with verified provenance — carrying Safeguard Attestation Level 0.
Gold is Safeguard’s bar for an open-source component you can ship with confidence. To be Gold, a component must meet four requirements: NO KNOWN high- or critical-severity vulnerabilities at the last scan; MALWARE-FREE; LICENSE-COMPLIANT (its license is identified, its obligations mapped, and free of conflicts); and VERIFIED PROVENANCE (its origin and build are traceable and attested). A component meeting all four carries a Safeguard Attestation — Level 0 is the baseline, attesting the component passed this automated verification with a reproducible result.
Verification is continuous, not a one-time stamp: a component that picks up a new high or critical vulnerability — or loses license clarity — drops Gold until it is restored, so the ★ GOLD badge always reflects the component’s state right now. Packages currently meeting the bar are browsable in the Gold packages directory.
Attestation levels build on the Level 0 foundation — higher levels add stronger provenance (SLSA), deeper license assurance, and supply-chain guarantees on top of the baseline no-known-vulnerability / no-known-malware / license-compliant bar.