In Cursor, install the Safeguard extension from Open VSX and run "Safeguard: Check Staged Commit for Secrets" before you commit. For a full sweep of the working tree, open Cursor's terminal and run the Safeguard CLI detect command for secrets. Then rotate anything real.
What can the extension do, and what can it not?
Cursor installs extensions from Open VSX, and the Safeguard extension is the same package as the VS Code one. The docs list one command aimed at this task, "Safeguard: Check Staged Commit for Secrets". The IDE page does not explain how that check works inside. It points to the secrets scanning docs for the underlying capability, which say pre-commit protection comes from the IDE extension.
The rest of the extension is about dependencies: manifest scanning, inline warnings, fix strategies and SBOM export. That is useful, but it is not secrets work, so do not expect the dependency panels to show a leaked key.
The extension is not the whole story either. The secrets docs say there is no CLI command yet for installing a git hook, and none for listing, revoking or rotating findings. For triage and rotation tracking you use the Secrets dashboard in the web app.
How do you set it up?
Install from the command line or from the Extensions view by searching "Safeguard":
cursor --install-extension Safeguard-sh-Inc.SafeguardshIdeExtension
Then run "Safeguard: Login" from the command palette. It uses an OAuth device flow, so you approve a code in the browser. The docs say public package scanning works without signing in, while backend features need it. Whether the staged secrets check needs a login is not stated, so sign in first and avoid guessing.
How do you scan the whole tree from Cursor's terminal?
The extension looks at what you staged. Secrets often hide in files you never stage, such as old config, test fixtures or a scratch file. Run the CLI in the integrated terminal:
safeguard detect --detect secrets
To save results as SARIF:
safeguard detect --detect secrets --format sarif --output detect.sarif
The format can be table (the default), JSON or SARIF. You can also limit the report to a minimum severity. The docs say secret values are redacted in the output unless you switch redaction off, so a shared terminal log will not carry the raw key by default. Leave redaction on unless you have a reason.
The usage page does not document exit codes for detect, git history scanning from this command, or ignore lists. Run the help output for the CLI to check what your installed version supports. The help output wins if it disagrees with the docs.
What does the platform detect?
The secrets docs describe three overlapping layers: issuer specific patterns for more than 200 providers such as AWS, GitHub, Stripe, Slack and OpenAI keys, generic patterns such as private keys, JWTs and connection strings, and entropy checks that flag random looking strings while filtering hashes and UUIDs. Safeguard can verify some findings with a low privilege call to the issuer. The docs list surfaces beyond the working tree, including Git history, container layers and build logs, which you reach through the platform and not through the editor.
A realistic workflow
You paste a key into a test file while debugging an API. You stage the change. The staged check flags it. You remove the key and commit. Later, a weekly terminal sweep finds the same key in an old fixture you never touched. That is why you want both checks.
If a real credential was ever committed, treat it as exposed even after you delete it. Removing it from the latest commit does not remove it from history.
What to do
- Install the extension in Cursor from Open VSX and sign in.
- Run the staged commit secrets check before each commit.
- Run the CLI detect command for secrets on the full working tree.
- Export SARIF if your CI or code scanning view can read it.
- Revoke and rotate any real credential, in the provider's console first.
- Check history, not just the current files, using the platform.
- Move the secret into a secrets manager or environment variable.
Try the flow in the demo first if you want to see a finding before installing.
Click through it at your own pace, or open it full screen.
Quick check
Does the Safeguard Cursor extension scan the whole repo for secrets?
The documented command checks staged commits. For the whole working tree, use the CLI detect command in the terminal.
Where does Cursor get the extension?
From Open VSX, using the same package as the VS Code version.
Is deleting a leaked key from the file enough?
No. Revoke and rotate it. The old value stays in Git history and may already have been copied.
Sources
Last reviewed: 18 October 2026.
