Start with an inventory, scan only what is declared, run gates in report-only mode, and block builds last. Studios have unusual inputs, such as engine plugins, asset packs and native libraries, so week one is about finding them, not about buying tools.
Week 1: find what you ship
Make a list per game of everything that ends up in a build.
- Engine and its exact version.
- Packages from the engine's package manager. Unity's Package Manager records its resolution in a lock file, and Unreal plugins with a Source folder are compiled by the build tool, per the vendors' documentation.
- Plugins and addons, including ones installed outside the repository.
- Native libraries and middleware binaries.
- Web template scripts for browser builds.
- Build and art tools: the Git LFS client, content tools and their add-ons.
The inventory guide for engines, middleware and asset packs gives a layout. Name an owner for each entry.
Week 2: scan what is declared
Point scanning at manifests and lock files. They are small, readable and stable. Check that the scanner supports the package formats your engine uses before you count on it, and write down gaps. For files hidden by Git LFS, fetch the content before scanning, as explained in the LFS post.
Triage the first results by reachability and exposure, not by raw score. A finding in an editor-only package that never ships matters less than one in code that runs on a player's device. The vulnerability management demo shows the idea.
Week 3: gates in report-only mode
Add a pull request check that reports new findings but never blocks. Share the output weekly. Fix the noisy rules first, because a gate that cries wolf gets switched off. Decide which severity and which package categories would justify blocking later.
Week 4: turn on the first blocking rule
Pick one narrow rule, such as no new package from an unreviewed source, and enforce it. Keep an exception path with an expiry date and a named approver. Extend slowly.
What to leave for later
- Console SDK paths. Review your agreements first. See the NDA post.
- Perfect coverage of art assets. Start with code.
- Complicated scoring. Keep one list of what must be fixed this sprint.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis and policy gates, and you can run a free scan at https://gold.safeguard.sh/scan on a repository to see what a first report looks like.
Try it yourself
Click through it at your own pace, or open it full screen.
Step through the pull request gate and look for where a report-only check would sit before a blocking one.
Quick check
Should gates block builds from day one?
No. Start in report-only mode, fix noisy rules and then block on one narrow rule.
Where do I start if I have no inventory?
With the engine version and the manifest or plugin list for one game. Expand from there.
Sources
Last reviewed: 19 October 2026.
