How to fix a vulnerable dependency with the Safeguard VS Code extension

Install the Safeguard extension in VS Code, run Safeguard: Login, scan the project, then apply a version bump from the lightbulb menu above a flagged dependency, or run Fix All Vulnerabilities. Choose a remediation strategy first, and always read the diff and run your tests before you commit.

How do you set it up?

1. Install it from the VS Code Marketplace. The docs give the command line form below, or you can search for Safeguard in Extensions. VS Code 1.85 or later is required.

code --install-extension Safeguard-sh-Inc.SafeguardshIdeExtension

2. Open a workspace that has a supported manifest, for example package.json, requirements.txt, pom.xml, go.mod, Cargo.toml or Gemfile. The extension activates on its own.
3. Open the command palette and run Safeguard: Login. Authentication uses a device flow.

What do you see after scanning?

Auto scan and scan on save are on by default, so findings appear as you work. You get inline warnings, hover summaries, and CodeLens actions above vulnerable dependencies. A Safeguard view in the activity bar has panels for Vulnerabilities, SBOM, Compliance and Recommendations, and Export Report saves findings from a panel. To scan on demand, run Safeguard: Scan Project for Vulnerabilities.

Which strategy should you pick?

The extension offers three, set with Safeguard: Set Remediation Strategy or the remediation strategy setting. Balanced is the default.

• Safe: minor updates only.
• Balanced: minor and patch updates.
• Aggressive: the latest available version.

Start with Safe on a service with thin test coverage. Use Aggressive on a branch, where a failed build costs little.

How do you apply a fix?

There are three routes.

1. One finding from the editor. Hover over the flagged dependency, press Ctrl+. (Cmd+. on Mac), and choose a suggested fix from the lightbulb menu.
2. One finding by command. Run Safeguard: Auto-Fix Vulnerability (Bump Version).
3. Everything at once. Run Safeguard: Fix All Vulnerabilities.

The setting for fixing on save is off by default. Leave it off until you trust the workflow, since silent edits to a manifest are easy to miss in review.

What should you check afterward?

The docs we reviewed do not describe how lockfiles or transitive dependencies are handled, so do not assume. After any fix:

• Read the diff of the manifest and the lockfile.
• Run the install and your test suite.
• Check that the flagged item cleared on a rescan.
• If a bump is wrong for you, use Safeguard: Ignore Vulnerability and record why in the pull request.

What if a fix breaks something?

A version bump can change behavior even within a minor release. Plan for it before you press the button.

1. Work on a branch, never on the main line.
2. Apply one fix at a time for the first few, so a failure points at one change.
3. If the build fails, revert that change and read the release notes of the new version.
4. Pick a more conservative strategy for that dependency, or mark the finding as ignored with a reason and a date to revisit.
5. For a critical finding with no safe upgrade path, reduce exposure in another way and track it.

Ignoring a finding is a decision, so record who made it and why. The extension lets you ignore a vulnerability, but it cannot decide for you whether the risk is acceptable.

Try the full walkthrough at /demos/gate-dev-ide.

What to do

1. Install the extension and sign in.
2. Pick a remediation strategy that matches the service's test coverage.
3. Scan the project and sort by severity.
4. Apply a fix, then review the manifest and lockfile diff.
5. Run tests and rescan.
6. Commit on a branch and open a pull request with the finding noted.

Quick check

Sources

• Safeguard docs: IDE Support

Last reviewed: 18 October 2026.