A security tool often gets read access to your source code, build pipeline and sometimes secrets, so it deserves a stricter vendor review than most software. Check what it can access, where your data goes, how long it is kept, and how the vendor handles its own incidents.
Map the access it asks for
List every permission the tool requests and compare it with what it needs.
- Source host: read only, or write? Write access is needed for automated fix pull requests, so decide if you want that.
- Which repositories: all, or a selected list?
- Does it need CI secrets or tokens, and how are they stored?
- Does it run inside your environment, or does code leave it?
Prefer the narrowest scope that does the job. You can widen it later. Narrowing after an incident is harder.
Trace the data flow
Ask for a diagram and check it against what you observe.
- Is source code uploaded, or only metadata, dependency lists or hashes?
- Where is it processed and stored, and in which region?
- How long is it retained, and can you shorten that?
- Are sub processors used, and are they listed?
- If AI features exist, is your code sent to a model provider, and is it used for training?
Our data handling RFP questions go deeper on wording.
Review how they build and run their own product
- Do they publish an incident response commitment, including notification timing for customers?
- Do they provide signed artifacts or an SBOM for their agent, CLI or plugins? See questions about secure development.
- How are administrator accounts protected, with what multi factor options?
- Is there an audit log of actions in your tenant, and can you export it?
- What independent assurance reports exist? Ask for the actual document and read the scope, since the scope shows what is covered.
Do not accept a logo on a web page as evidence. Ask for the report, the date and the scope.
Check the components that run in your environment
Agents, CI plugins, IDE extensions and browser extensions execute on your machines. Review them like any other third party code:
- Who publishes the package and how is it signed?
- What permissions does an extension request?
- How do updates arrive, and can you pin versions?
A tool that scans your supply chain can itself be a supply chain risk. Handle it with the same checks.
Write the findings down
Record the access granted, the data shared, the residual risks and the compensating controls. Set a review date, usually annual or on any major product change. This record also helps when a customer asks how you assess your own suppliers.
Safeguard publishes download surfaces and a free scan so a team can try the product on a test project before granting broader access.
Quick check
Can a self hosted option skip this review?
No. It changes the data flow but not the need to review the software that runs in your environment and the updates it receives.
Who signs off?
Security owns the technical review, and procurement or legal owns contract terms. Record both approvals.
Last reviewed: 19 October 2026.
