Install the Safeguard CLI, run safeguard detect with the secrets option on your project folder, and read the findings in table, JSON or SARIF form. Rotate any real credential first, then clean up history. The CLI finds secrets on your machine and only results leave it, but it does not rotate keys for you.
Commands below come from the Safeguard CLI and secrets scanning documentation, read on 18 October 2026. Run the help command in your own build, because the docs say help output wins if it disagrees with a page.
How do you install it and sign in?
On macOS and Linux the docs give a one line installer, and on Windows a PowerShell one:
curl -fsSL https://cli.safeguard.sh/install | bash
irm https://cli.safeguard.sh/install.ps1 | iex
The CLI is a single static binary, so there is no runtime to install. To sign in, run the safeguard command, type /login in the terminal, and approve the session in your browser. Scanning for secrets itself works on your machine.
How do you scan a folder for secrets?
The docs name the command and the option:
safeguard detect --detect secrets
The CLI overview says detect finds hardcoded secrets and misconfigurations and can emit table, JSON or SARIF output. Run the detect command with the help flag to see the exact option for choosing the format and the path in your version. The product page also shows detect taking a path argument for the project directory.
A regular safeguard scan of a directory also writes machine readable artifacts, and the CLI page lists a secret.json file among those written per run, next to vulnerability and license files. Use whichever fits your pipeline.
What does a finding tell you?
Safeguard's secrets documentation describes three detection layers: issuer specific patterns for more than 200 providers, generic patterns such as private keys, JSON web tokens and connection strings, and entropy based detection for high entropy strings. For issuer patterns it describes verifying a secret with a low privilege call to the issuer. Unverified findings are still raised and marked unverified, and verified findings mean the secret is live. The docs let you disable verification per issuer where outbound calls are restricted.
Severity follows verification: critical for a verified high privilege credential, high for a verified lower privilege one, medium for an unverified match for a known issuer, and low for generic or entropy findings.
What do you do about a real secret?
Order matters. First revoke or rotate the credential at its source. Then remove it from code and deploy the replacement from a secret manager. Only then worry about git history, since anyone who cloned the repository already has the old value. History rewriting with tools like git-filter-repo needs force pushes and coordination.
The docs describe a remediation playbook of revoke, rotate, purge from history and notify, run from the platform's Secrets dashboard. They also say plainly that there is no CLI command yet for listing, revoking or rotating secret findings, so use the dashboard for that.
How do you handle false positives?
Documentation examples sometimes look like keys. The docs describe three allowlist scopes: an inline comment of the form safeguard:allow followed by a reason, path based globs in a file named .safeguard/secrets-allow.yaml, and issuer based allowlisting for unverified findings. Custom patterns for internal tokens go in .safeguard/secrets.yaml. Allowlist entries are tracked in audit, so give a real reason each time.
What are the limits?
The docs say there is no CLI command for installing a git hook yet, so a local pre-commit hook needs your own wrapper, and the IDE extension is described as the tool that blocks secrets before a push. The CLI does not decide policy: gates are evaluated in the platform.
Try the walkthrough at /demos/secrets-scanning.
What to do
- Install the CLI and read the detect command's help output to confirm options.
- Run the secrets scan on your working tree and save the JSON or SARIF output.
- Triage by severity, starting with verified findings.
- Revoke or rotate each real credential at its source.
- Replace it with a value from a secret manager and redeploy.
- Decide whether history needs rewriting and coordinate any force push.
- Allowlist true false positives with a written reason.
- Add the scan to CI and the IDE extension to catch the next one early.
Quick check
Does the scan send my source code anywhere?
The CLI docs say it scans on your machine and sends only results when you upload them or a runner returns a job.
Can the CLI rotate a leaked key?
Not according to the docs. There is no CLI command yet for revoking or rotating secret findings. Use the dashboard and the issuer's own tools.
Sources
- Safeguard CLI, Safeguard Docs, read 18 October 2026
- Secrets Scanning, Safeguard Docs, read 18 October 2026
- Safeguard CLI product page, read 18 October 2026
Last reviewed: 18 October 2026.
