Safeguard Desktop lets you query every CVE, component, project and control you have scanned in plain English. The skill is asking questions that have a checkable answer. Here are ten that work well, and a habit for verifying what comes back.
Why the wording of a question matters
The download page describes Desktop as a place to ask your supply chain anything, covering what you have scanned. That last part is the limit. A tool can only answer from data it holds, so a question about a project you never scanned will come back empty, and an empty answer is not proof of safety.
Good questions name a scope (a project, an ecosystem, a severity) and a test (affected, fixable, exposed). Vague questions get vague answers.
Ten questions to try
About components:
- Which projects use a specific package, and at which versions?
- Which components have no maintainer activity you can see?
- Which direct dependencies pull in the most transitive ones?
About vulnerabilities:
- Which critical findings in this project have a fixed version available?
- Which findings are on CISA's Known Exploited Vulnerabilities list?
- What changed in the last scan compared with the one before?
About projects:
- Which project has the most open high severity findings?
- Which projects have not been scanned recently?
About controls:
- Which controls have no evidence attached?
- Which findings block a policy I have set?
Not every one of these will map to data in your workspace. Treat the list as prompts, and adjust to what you have actually scanned.
Check the answer, every time
A natural language answer is a summary. Before acting on it, do three things.
First, ask for the list behind the number. If it says twelve findings, you should be able to see twelve rows.
Second, spot check one row against a primary source. For a CVE, the CISA Known Exploited Vulnerabilities catalog says it is maintained as the authoritative source of vulnerabilities exploited in the wild, and the OSV database records the affected version ranges for open source packages. If a tool says a package is affected, the advisory should say the same.
Third, note the scan time. An answer from last week's scan describes last week.
Questions that need judgment
Some questions look factual but are not. "Is this safe to ship?" is a decision, not a lookup. A better form is "What is blocking release, and what is the smallest change that clears it?" The tool lists, you decide.
Keep a question log
Teams that use a query tool well keep a short list of questions that proved useful, with the date and who asked. It becomes a weekly review script. See the daily and weekly dependency review workflow for one way to structure it.
Where Safeguard fits
Safeguard Desktop is the native window for these questions, and the CLI and IDE extensions cover other moments in the day. To see what a scan produces without an account, the free scan at gold.safeguard.sh/scan accepts a manifest or an SBOM.
Quick check
Can Desktop answer questions about projects I have not scanned?
No tool can answer from data it does not have. The page describes the app as covering what you have scanned.
How do I trust a plain English answer?
Ask for the rows behind it, spot check one against an advisory, and note the scan time.
Sources
- Safeguard download page
- CISA Known Exploited Vulnerabilities Catalog
- OSV, Open Source Vulnerabilities
Last reviewed: 19 October 2026.
