In the Safeguard desktop app, which is in early access beta, grant the project folder in the Files tab, open the Terminal tab and run the Safeguard CLI secrets detection on it. The Scan tab runs vulnerability scans, so secrets work goes through the terminal. Then rotate anything real, since a leaked key stays exposed after you delete it.
What does the desktop app actually do here?
The desktop docs describe an app with a web view of app.safeguard.sh on the left and a local panel on the right. The panel's tabs are Scan, Terminal, MCP, Tasks, Files and Settings. The Scan tab adds local projects, runs vulnerability scans and groups results by severity. The docs do not describe secrets results in that tab, so we do not promise them.
The Terminal tab runs commands from a fixed allowlist, and the allowlist includes the Safeguard CLI binaries. The CLI's secrets detection is documented, so that is the route.
How do you run it?
Step 1. Open the panel. Press Cmd+Shift+S on macOS or Ctrl+Shift+S on Windows and Linux.
Step 2. Grant the folder. In the Files tab, choose the project folder with the operating system file picker. The app can read only folders you grant, and commands must start inside a granted folder.
Step 3. Run detection. In the Terminal tab, run the command from the secrets scanning docs:
safeguard detect --detect secrets
The docs describe output formats including a table by default, JSON and SARIF, and say secret values are redacted in output unless you switch redaction off. Keep redaction on. A screen full of raw keys is its own leak.
If your installed version differs from the docs, run the CLI help in the same terminal and trust that output. The desktop docs also note the app falls back to manifest analysis for scanning when its bundled CLI binary is missing for your platform, which is another reason to check what actually ran.
What does this cover and not cover?
The secrets docs list the surfaces the platform scans: current source, Git history, container image layers, packaged artifacts, build logs and vendor SBOMs. They also say there is no CLI command yet to install a git hook, and none to list, revoke or rotate findings. For triage, you use the Secrets dashboard in the web app.
So treat the desktop run as a working tree check. Whether this command also reads Git history is not documented on that page. The docs describe deep history scanning as part of connecting a repository to the platform. For an old repo, connect it and run the history scan there, or confirm the command's behavior in its help output.
The docs also describe verification: for many issuers, Safeguard makes a low-privilege call to the issuing service and marks the finding verified or unverified. We cannot say from the docs whether a local terminal run does this, so read the labels in your output and do not assume.
What do you do with a finding?
Treat a real credential as exposed from the moment it was committed.
- Revoke or rotate it in the provider's console first.
- Check the provider's logs for use you do not recognize.
- Move the replacement into a secrets manager or environment variable.
- Remove it from the file and, if needed, from history. History rewriting needs a force push and affects everyone, so plan it.
- Add an allowlist entry only for true placeholders such as documentation examples, with a reason.
Why bother with the desktop app?
Two real advantages from the docs: folder access is explicit and scoped, and the Terminal tab restricts what can run and where. For someone who wants a quick check on a project without wiring up CI, that is a reasonable setup. For team enforcement, use the IDE extension for pre-commit checks and the platform for history and dashboards.
What to do
- Install the beta desktop app and sign in.
- Open the panel and grant the project folder.
- Run the secrets detection in the Terminal tab and keep redaction on.
- Save a SARIF copy if you want to attach it to a ticket.
- Rotate every real credential, then clean up.
- Connect the repo to the platform for history scanning.
- Add the IDE extension for pre-commit checks.
Want to see a finding before you install anything? Try the demo.
Quick check
Does the Scan tab find secrets?
The docs describe it as running vulnerability scans. Use the Terminal tab with the CLI secrets detection for secrets.
Is deleting the secret from the file enough?
No. It remains in Git history and may have been copied. Revoke and rotate it.
Sources
Last reviewed: 18 October 2026.
