To fix a vulnerable dependency in the Safeguard desktop app, grant it the project folder, run a scan from the Scan tab, read the safe upgrade target on the finding, apply that version with your package manager in the Terminal tab, then scan again. The desktop app is in early access beta.
What is the desktop app?
The Safeguard desktop app is an Electron application for macOS, Windows and Linux. It is in early access, so treat features as subject to change. According to the documentation, the left side of the window, about three quarters, shows the Safeguard web app and you sign in as you would in a browser. A local panel on the right, about a quarter, gives access to your files, a shell and MCP servers.
The panel has tabs: Scan, Terminal, MCP, Tasks, Files and Settings. This walkthrough uses Files, Scan and Terminal.
How do I run the fix loop?
Step 1. Grant the folder. Open the Files tab and grant access to the project folder through your operating system file picker. You can revoke access later from the same tab.
Step 2. Scan. Open the Scan tab and choose a quick or full scan. Results are grouped by severity. Start with the critical and high groups.
Step 3. Read the finding. The software composition analysis docs say each finding includes the safe upgrade target and the full transitive path from your project root to the vulnerable package. The path matters. If the vulnerable package is two levels down, bumping your direct dependency may be the real fix, and a manual override of the deep package may be a risky shortcut.
Step 4. Apply the bump. Open the Terminal tab. It runs allowlisted commands such as git, docker and npm. Create a branch first with git switch -c fix/dependency-bump, then run the upgrade with your package manager, for example npm install package-name@version using the target from the finding.
Step 5. Test. Run your own test suite in the same tab. A security fix that breaks the build will be reverted by someone tired at 6 pm.
Step 6. Rescan. Run the scan again and confirm the finding is gone and nothing new has appeared.
What does the desktop app not do?
We could not find documentation of a one-click fix button in the desktop app, so this walkthrough applies the upgrade yourself. The Tasks tab lets you submit natural-language tasks and approve or deny destructive actions, which you may find useful for scripted follow-up, but check the in-app behavior before relying on it.
Reachability analysis is a separate Safeguard capability that helps decide which findings deserve work first. Use it to sort a long list before you start bumping versions.
What to do
- Install the desktop app and sign in.
- Grant only the folder you are fixing.
- Run a scan and sort by severity.
- For each finding, read the transitive path and the safe upgrade target.
- Bump on a branch, run tests, rescan, then open a pull request.
- Keep the scan output in the pull request so a reviewer can see the before and after.
Quick check
Is the Safeguard desktop app generally available?
No. It is an early access beta, so expect changes between releases.
Where do I find the version to upgrade to?
On the finding itself. Each software composition analysis finding includes the safe upgrade target and the path from your project root to the vulnerable package.
Sources
- Safeguard docs: Desktop Application, fetched 18 October 2026
- Safeguard docs: Software Composition Analysis, fetched 18 October 2026
Last reviewed: 18 October 2026.
