With the Safeguard desktop app you can scan project folders locally from the panel, then use the web view to create a compliance report for a framework and date range, and use the CLI report command for scan artifacts. The app collects and formats evidence. Your auditor decides whether it satisfies a framework, and Safeguard does not certify anyone.
This guide follows the Safeguard documentation and download page as read on 18 October 2026. We describe only steps the docs state.
What does the app give you?
The desktop app wraps the Safeguard web app and adds a local panel, per the docs. The left view is app.safeguard.sh. The right panel has Scan, Terminal, MCP, Tasks, Files and Settings tabs. You can open the panel with Cmd+Shift+S on macOS or Ctrl+Shift+S on Windows and Linux.
For evidence, three pieces matter: local scan results, framework reports and an audit trail.
How do you collect scan evidence?
In the panel, open Files and grant a project folder through the operating system file picker. Open Scan, add the project, choose quick or full mode and run it. Results are grouped by severity. Re-run on demand or switch on auto scan for the project. Per the docs, scanning is local, so the project is not pushed anywhere first.
For something you can hand over, the CLI page describes safeguard report as generating a report from an existing scan result, the artifact you hand an auditor. The desktop Terminal tab can run the Safeguard CLI inside granted folders. Run the command help to see the flags in your build, since the CLI docs say help output wins over the written page.
How do you produce a framework report?
The Safeguard compliance documentation describes a flow in the web app: navigate to Reports, click Create Report, select a compliance framework, configure the scope and date range, then generate and export. It lists pre-built reports including an SBOM completeness audit and a vulnerability summary, and says custom reports can be made for specific requirements. For SOC 2, ISO 27001, the HIPAA Security Rule, PCI DSS and NIST CSF 2.0 the docs say Safeguard also maps automated tests from the systems you connect.
The docs further say each framework page explains which requirements a scan can decide and which need your own evidence. That distinction is the honest boundary: a scan can show a dependency inventory is complete, it cannot show that your team reviewed access last quarter.
What about the audit trail and the auditor?
The compliance page lists audit support: audit trails, evidence collection, read-only assessor access and documentation packages. Ask your administrator what is enabled in your workspace. Give an assessor the narrowest access that works, and time limit it.
Nothing in this post means your organization is certified by using the app, and the docs state plainly that Safeguard does not currently hold a FedRAMP authorization.
What are the limits?
The app is a way to gather and package. It does not replace policy documents, human reviews or your auditor's judgment. Windows builds are not yet code signed according to the docs, so verify the checksum on download if your security team asks.
What to do
- Install the desktop app from the download page and verify the checksum if required.
- Grant folder access to each in-scope project and run a scan, noting quick or full mode.
- In the web view, open Reports and create a report for your framework, scope and dates.
- Export it and store it with the date and the scope description.
- Run the CLI report command for scan artifacts you want to attach.
- List which requirements the report does not decide, and collect your own evidence for them.
- Set up read-only assessor access with an expiry if your auditor needs it.
- Repeat on a schedule so evidence exists across the whole audit period.
Quick check
Does using the app make me compliant?
No. It helps collect and format evidence. Your auditor decides, and Safeguard does not certify organizations.
Do scans in the app upload my source?
The docs describe the panel scan as local, and the CLI as sending only results. Check your workspace settings for anything beyond that.
Sources
- Download Safeguard, read 18 October 2026
- Desktop Application, Safeguard Docs, read 18 October 2026
- Compliance, Safeguard Docs, read 18 October 2026
- Safeguard CLI, Safeguard Docs, read 18 October 2026
- Safeguard CLI product page, read 18 October 2026
Last reviewed: 18 October 2026.
