Zero high & critical vulnerabilities, malware-free, license-compliant, with verified provenance — carrying Safeguard Attestation Level 0.
Gold is Safeguard’s bar for an open-source component you can ship with confidence. To be Gold, a component must meet four requirements: ZERO high- and critical-severity vulnerabilities; MALWARE-FREE; LICENSE-COMPLIANT (its license is identified, its obligations mapped, and free of conflicts); and VERIFIED PROVENANCE (its origin and build are traceable and attested). A component meeting all four carries a Safeguard Attestation — Level 0 is the baseline, attesting the component passed this automated verification with a reproducible result.
Verification is continuous, not a one-time stamp: a component that picks up a new high or critical vulnerability — or loses license clarity — drops Gold until it is restored, so the ★ GOLD badge always reflects the component’s state right now. Packages currently meeting the bar are browsable in the Gold Certified directory.
Attestation levels build on the Level 0 foundation — higher levels add stronger provenance (SLSA), deeper license assurance, and supply-chain guarantees on top of the baseline zero-vuln / zero-malware / license-compliant bar.