To fix a vulnerable dependency in Cursor, install the Safeguard extension from Open VSX, sign in, open your manifest, hover the flagged package and pick a fix from the lightbulb menu. Choose a remediation strategy first, then review the version change and run your tests before you merge.
How do you install it in Cursor?
Cursor installs extensions through the Open VSX registry, not the VS Code Marketplace. Safeguard publishes the same extension package to both. From a terminal:
cursor --install-extension Safeguard-sh-Inc.SafeguardshIdeExtension
Or open Extensions in Cursor, search for Safeguard and click Install. The extension activates when your workspace holds a manifest such as package.json, requirements.txt, pom.xml, go.mod, Cargo.toml or a Gemfile. It reads npm, Yarn, pnpm, pip, Poetry, Pipenv, Maven, Gradle, Go modules, Cargo and Bundler files.
How do you sign in?
Run "Safeguard: Login" from the Command Palette. A browser tab opens at app.safeguard.sh with a code. Approve the device and go back to Cursor. No tenant ID entry is needed, and tokens go into the IDE's credential storage. Scanning public packages works without signing in, but backend-verified checks need it.
What do you see?
By default the extension scans on open and on save, and it shows inline warnings on vulnerable dependencies with a CodeLens above them. A Safeguard view in the activity bar has panels for Vulnerabilities, SBOM, Compliance and Recommendations. You can also run "Safeguard: Scan Project for Vulnerabilities" from the Command Palette at any time.
How do you pick a fix strategy?
Safeguard offers three remediation strategies, set with the safeguard.remediationStrategy setting.
- Safe: minor version updates only. Least risk of breakage.
- Balanced: minor and patch updates. This is the default.
- Aggressive: updates to the latest available version.
Start with Safe for a service you cannot easily retest, and move up when your tests are good. A vulnerable package that is only fixed in a new major version will not be solved by Safe, and that is a decision you should make by reading the changelog, not by clicking.
What to do: how do you apply the fix?
- Open the manifest, for example package.json.
- Hover the flagged dependency to read the summary.
- Open the lightbulb menu with Cmd+. on a Mac or Ctrl+. elsewhere, and choose a suggested fix. Or run "Safeguard: Auto-Fix Vulnerability (Bump Version)" from the Command Palette. "Safeguard: Fix All Vulnerabilities" applies fixes across the project.
- Look at the changed version in the diff. Update the lockfile with your package manager.
- Run your build and tests.
- Commit the manifest and lockfile together.
Leave "autoFixOnSave" at its default, which is off. Automatic version changes on every save are hard to review.
Can you ask questions in the editor?
The VS Code and Cursor extension includes a chat panel. Open it with Cmd+Shift+S or Ctrl+Shift+S and ask things like why a package is vulnerable or what the safest fix is. Use "Safeguard: Analyze Selected Code" when you have highlighted a block. Treat the answers as a starting point, as with any assistant, and confirm against the advisory.
What does it not do?
It fixes dependency versions. It does not rewrite your code to adapt to an API change in a new major version, and a version bump that passes your tests today may still change behavior. Cursor's own AI features and Safeguard's assistant are separate, so check which one is proposing a change. The Safeguard extension can also connect to Cursor over MCP, with a separate setup described in the docs, if you want your assistant to query your workspace data.
Quick check
Why does Cursor install from Open VSX?
Cursor uses the Open VSX registry rather than the Microsoft VS Code Marketplace. Safeguard publishes the same extension package to both, so the features match.
Is the Aggressive strategy safe to use?
It updates to the latest available version, which can include breaking changes. Use it on code with good test coverage and review the diff before merging.
Sources
Last reviewed: 18 October 2026.
