Attribution

Credits & Data Sources

Safeguard Gold stands on the work of the publishers, registries, and research programs below. We aggregate, normalize, and enrich their public data — the original records belong to them, and we thank every one of these teams.

Vulnerability Intelligence

National Vulnerability Database (NVD)NIST — U.S. National Institute of Standards and TechnologyCVE metadata, CVSS scoring, and reference material.CVE ProgramThe MITRE CorporationCVE identifiers and vulnerability records.OSV.devGoogle / Open Source Security FoundationOpen-source vulnerability advisories and affected-version ranges.GitHub Security AdvisoriesGitHubGHSA advisories for ecosystem packages.CISA KEV CatalogCISA (U.S. Cybersecurity and Infrastructure Security Agency)The Known Exploited Vulnerabilities catalog behind our "actively exploited" flags.EPSSFIRST.orgExploit Prediction Scoring System scores shown on CVE pages.OpenSSF ScorecardOpen Source Security FoundationAutomated repository security-health scores and checks shown in the package-health card.Malicious PackagesOpen Source Security Foundation / OSVPublic advisories (OSV, GHSA, CVE) behind our malicious-package / supply-chain incident reference.

Weakness Taxonomies

Common Weakness Enumeration (CWE™)The MITRE CorporationWeakness-class definitions, hierarchy, and mitigations behind our CWE index.OWASP Top 10OWASP FoundationWeb application risk categories mapped onto our weakness data.

Adversary Tactics & Techniques

MITRE ATT&CK®The MITRE Corporation© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Enterprise, Mobile, and ICS tactics, techniques, mitigations, groups, software, and campaigns behind our ATT&CK section.

AI Models

HuggingFace HubHugging FaceOpen-model metadata (downloads, likes, license, task) behind the AI models directory.

AI Agent Ecosystem

MCP RegistryModel Context Protocol / AnthropicThe official MCP server registry behind our MCP servers directory.Anthropic Agent SkillsAnthropicOfficial Agent Skills behind the skills directory.Superpowersobra (open source)Community agent skills featured in the skills directory.

Package Registries

npm Registrynpm, Inc. (GitHub)JavaScript/TypeScript package metadata.PyPI — Python Package IndexPython Software FoundationPython package metadata.Maven CentralSonatypeJava/JVM artifact metadata.Go Module IndexGoogleGo module metadata.RubyGemsRuby CentralRuby gem metadata.crates.ioRust FoundationRust crate metadata.PackagistPackagist ConductorsPHP/Composer package metadata.NuGet GalleryMicrosoft / .NET Foundation.NET package metadata.

Container Registries

Docker HubDocker, Inc.Public container-image metadata for the images directory.GitHub Container Registry (GHCR)GitHubPublic container-image metadata for the images directory.
CVE®, CWE™, and ATT&CK® are marks of The MITRE Corporation. All product names, logos, and brands referenced on this page are the property of their respective owners and are used for identification and attribution only. Data from these sources is provided as-is by its publishers; Safeguard's verification, scoring, and Gold certification are our own analysis layered on top. If you publish data we use and would like your attribution adjusted, contact hi@safeguard.sh.