API & Badges

Developers

Query Gold Open Source programmatically and show your project's security status with a live README badge — free, read-only, no API key.

README badge

Embed a live Safeguard Gold status badge in any README or docs. It updates automatically as a package's security status changes.

Safeguard Gold status badge example

Markdown:

[![Safeguard Gold](https://gold.safeguard.sh/badge/npm/lodash)](https://gold.safeguard.sh/package/npm/lodash)

Pattern: /badge/<ecosystem>/<name> — e.g. /badge/pypi/requests, /badge/npm/@types/node.

CI gate — GitHub Action & CLI

Fail your build when a dependency is actively exploited (CISA KEV) or known-vulnerable — no account, no API key, and your source never leaves the runner. Drop this into .github/workflows/gold-scan.yml:

name: Gold Scan
on: [push, pull_request]
jobs:
  gold-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: safeguard-sh/gold-scan-action@v1
        with:
          fail-on: kev   # kev | vuln | none

Or run it anywhere with Node — pre-commit hooks, GitLab CI, or your laptop:

npx @safeguard/gold-scan . --fail-on kev

Supports npm, PyPI, crates.io, Go, RubyGems & Packagist manifests. Fails open if the API is unreachable, so a Gold outage never blocks your pipeline. Full docs →

Read API

All endpoints are GET, return JSON, and are rooted at https://gold.safeguard.sh. Read-only and free.

GET/api/packages?search=lodash&ecosystem=npm

Search packages (filter by ecosystem, status; paginated).

GET/api/packages/{name}

Package detail — vulnerabilities, license, version, live download count.

GET/api/packages/{name}/vulnerabilities

The CVEs affecting a package.

GET/api/packages/stats

Corpus-wide package statistics.

GET/api/vulnerabilities?search=&severity=critical

Search CVEs by keyword, severity, or ecosystem.

GET/api/vulnerabilities/{cve}

CVE detail — CVSS, EPSS, CISA KEV status, affected/fixed versions.

Example:

curl https://gold.safeguard.sh/api/packages/lodash

The API is provided as-is for read-only use. Data is aggregated from public sources — see Credits & Data Sources. Please cache badge/API responses rather than requesting them on every page load.