OSM & Gold: Open Source Intelligence

BeginnerFree7 modules · 19 lessons

About this course

The shared open-source intelligence layer beneath every Safeguard product: OSM's per-package scoring, and Gold's free directory plus its paid hardened-artifact registry.

What you'll learn

OSM: Know Before You Install

Per-Package Detail and LCAL
Malicious Packages and the Gold Directory

Gold: Free Directory and Paid Registry

gold.safeguard.sh, the Free Public Directory
The Gold Registry: Paid Hardened Artifacts

Reading Package Health Signals

OpenSSF Scorecard and What Each Check Means
Maintenance, Dependency Age and the Signals Behind a Risk Score
LCAL in Practice: Choosing Between Candidate Packages

The Gold Bar and the Operating Model

What the Gold Bar Requires, and Why Continuous Matters
The OSM Operating Model: Inventory, Patch, Fork, Harden
Adopting Gold Without Disrupting Developers

Using the Free Gold Intelligence Layer

The Public Directory: CVEs, KEV, SGZ and Malicious Packages
The Free API, Badges, CI Action and Extension
CWE, OWASP and ATT&CK: Using the Reference Layer

Ecosystem-Specific Risk

npm and the JavaScript Ecosystem
PyPI and the Python Ecosystem
Maven, Go and the Compiled Ecosystems

Building an Open Source Governance Practice

An Open Source Policy Engineers Will Accept
Contribution, Forking and the Upstream Relationship
Measuring Open Source Risk Over Time

01OSM: Know Before You Install2 lessons

Per-Package Detail and LCAL
Malicious Packages and the Gold Directory

02Gold: Free Directory and Paid Registry2 lessons

gold.safeguard.sh, the Free Public Directory

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

The Gold Registry: Paid Hardened Artifacts

03Reading Package Health Signals3 lessons

OpenSSF Scorecard and What Each Check Means
Maintenance, Dependency Age and the Signals Behind a Risk Score
LCAL in Practice: Choosing Between Candidate Packages

04The Gold Bar and the Operating Model3 lessons

What the Gold Bar Requires, and Why Continuous Matters
The OSM Operating Model: Inventory, Patch, Fork, Harden
Adopting Gold Without Disrupting Developers

05Using the Free Gold Intelligence Layer3 lessons

The Public Directory: CVEs, KEV, SGZ and Malicious Packages
The Free API, Badges, CI Action and Extension
CWE, OWASP and ATT&CK: Using the Reference Layer

06Ecosystem-Specific Risk3 lessons

npm and the JavaScript Ecosystem
PyPI and the Python Ecosystem
Maven, Go and the Compiled Ecosystems

07Building an Open Source Governance Practice3 lessons

An Open Source Policy Engineers Will Accept
Contribution, Forking and the Upstream Relationship
Measuring Open Source Risk Over Time

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.