No. The Safeguard Chrome extension does not scan or patch packages. Per Safeguard's docs, it opens a side panel that loads the same AI search page you would use in a browser tab. To fix a vulnerable dependency, use the VS Code extension or the CLI, and use the browser tools to look things up first.
What does the Safeguard extension do?
The docs describe it as AI search only. After you install it from the Chrome Web Store (Chrome 114 or later) and pin the icon, clicking the toolbar icon, titled Open Safeguard, opens a side panel. The panel loads the web app's search page at app.safeguard.sh, and you sign in inside the panel.
Details worth knowing:
- The extension has no separate login and stores no credentials. Sign in happens in the panel.
- It makes no Safeguard API calls of its own.
- Its only declared permission is the side panel, with no host permissions.
- The docs list a known issue: you may need to sign in again after a full browser restart, because of how the web app sets its session cookie. The docs say the fix is on the server side.
That makes it a convenient way to keep Safeguard search beside whatever page you are reading, such as an advisory or a package page.
Is there a second extension?
Yes. Gold Open Source is a separate Chrome extension for package lookups, backed by the free Gold directory at gold.safeguard.sh. Use it when you are on a registry page and want to see what is known about a package before you add it. It is also a lookup tool, not a fixer.
So how do you fix a dependency?
Use the tool that sits where the code is.
- VS Code extension. It shows inline warnings, offers fix actions above a vulnerable dependency, and can bump versions using a chosen strategy. See the companion post on fixing a dependency in VS Code.
- CLI. It scans a directory and has fix commands, including a dry run that previews changes and an option to open a pull request.
The browser extensions fit the step before: finding out whether a package or advisory matters, and what to ask next.
What should you not expect from it?
A few points save time. It does not read your repository, so it cannot tell you which of your projects use a package unless that information is already in your Safeguard account and you ask for it through search. It does not edit files. It does not run in the background and flag packages as you browse. The docs describe a side panel and nothing more, and that clarity is useful: you know exactly what the surface is for.
It also depends on the web app. If search works in a browser tab, it works in the panel, and if your tenant admin has switched off the browser extension client type, the panel will not be available. Safeguard's docs say tenant admins can switch off any client type, so check with your admin if the extension does not connect.
A sensible workflow that uses all three
- Read an advisory in your browser. Open the Safeguard panel and ask whether the package appears in your projects.
- Look up the package in Gold Open Source if you are weighing a replacement.
- Switch to your editor or terminal, and make the change there.
- Review the diff, run your tests, and open a pull request.
What to do
- Install the Safeguard extension from the Chrome Web Store and pin it.
- Sign in inside the panel, and run a search to confirm it works.
- Install the Gold Open Source extension for package lookups.
- Install the VS Code extension or CLI for fixes.
- If sign in does not persist across restarts, expect to sign in again, as the docs note.
Quick check
Does the Chrome extension scan my repository?
No. It opens the Safeguard search page in a side panel. Scanning happens in the CLI, the IDE extensions or the platform.
Which permissions does the extension request?
The docs list one: the side panel permission, with no host permissions.
Sources
Last reviewed: 18 October 2026.
