The Safeguard VS Code extension shows vulnerabilities, SBOM, compliance and recommendations in an activity bar view, flags risky dependencies inline as you edit, and offers a Review Pull Request command. It helps you fix issues before you open a pull request. Merge-blocking enforcement is handled by Safeguard policy gates, not by the extension alone.
We changed the angle of this post to match what the documentation shows. The extension helps you before the pull request. PR Guard and policy gates act on the pull request.
What does the extension show?
Per the Safeguard documentation, you install it from the VS Code Extensions view by searching for Safeguard, or from the command line. Cursor uses the same package through Open VSX. Run the Safeguard: Login command to sign in through a device flow. Scanning public packages works without logging in, but some features that depend on the backend need it.
Once active, you get:
- A Safeguard view in the activity bar with Vulnerabilities, SBOM, Compliance and Recommendations panels.
- Inline warnings on flagged dependencies, a hover summary and a lightbulb fix menu.
- A CodeLens above vulnerable dependencies with fix actions.
- Badges for Package Firewall verdicts when that setting is on.
- Export of a report from any panel.
The extension activates on manifests such as package.json, requirements.txt, pom.xml, go.mod, Cargo.toml and Gemfile. By default it rescans manifest files when you save them. You can set a severity threshold, from low to critical, and a remediation strategy of safe, balanced or aggressive.
How does it relate to the pull request?
Before you push, run Safeguard: Scan Project for Vulnerabilities, then use the fix actions. A clean local result means fewer failed checks later.
The extension also has a Safeguard: Review Pull Request command. The documentation page lists the command but does not explain it in detail, so we will not describe more than that.
For review on the pull request itself, the documentation describes PR Guard as an AI code review feature. It analyzes a pull request diff and returns a score, a summary and comments tied to files and lines, each with a severity and category, and sometimes a suggested fix. Setup needs the project's repository connected through a GitHub-backed integration. In the project's PR Guard tab you select a pull request and choose Run Review, and you can tick Post to GitHub to publish comments on the pull request.
Blocking a merge is a policy matter. The CI/CD documentation says the CLI reports findings and does not fail a build on them, and that enforcement is done by the platform's policy gates. Read the policies and gates documentation to set thresholds.
Walk through the idea at /demos/gate-pull-request.
What to do
- Install the extension and run Safeguard: Login.
- Open a project and review the Vulnerabilities and SBOM panels.
- Fix flagged dependencies with the lightbulb or CodeLens actions before you push.
- Connect the repository and try a PR Guard review on a test pull request.
- Configure policy gates on the platform for anything that must block a merge.
- Decide a severity threshold for the editor that your team can live with.
Quick check
Does the extension block merges?
No. It gives feedback in the editor. Merge blocking comes from Safeguard policy gates and your repository settings.
Does it work in Cursor?
Yes, the documentation says Cursor uses the same package through Open VSX.
Sources
- Safeguard documentation: IDE support
- Safeguard documentation: PR Guard
- Safeguard documentation: CI/CD integration
Last reviewed: 18 October 2026.
