You generate an SBOM in Safeguard from the web platform by connecting a source, then reading the result under Projects. The CLI and CI do the same job, and the platform also accepts Android APK uploads. The iOS and Android apps are listed on the download page, but the SBOM steps below are documented for the web.
What can you generate an SBOM from?
The documentation for SBOM generation lists these inputs: source repositories on Bitbucket, Git, GitHub and GitLab, container images from registries such as Amazon ECR, Docker Hub and OCI registries, AI models from Hugging Face, file uploads, CSAF or VEX files, Android APK files, and package manifests such as package.json and requirements.txt. The page does not name output formats, so check the product when you need a specific one.
How do you do it in the web app?
The documented steps are short.
- Open Integrations from the sidebar.
- Choose a source type, such as source code, container images, AI models or file uploads.
- Click Connect on the integration card. For a public repository, add the URL. For a private one, enter credentials and verify them.
- Select the repositories, then set the branch or tag, project name and version.
- Click Connect to finish. The configuration shows up in the Project Configurations table.
- Optionally set generation options such as Include Dev Dependencies and Deep Analysis.
The docs give a rough sense of time: under a minute for small projects, two to five minutes for medium ones and five to fifteen for large ones. Results appear under Projects, with findings counted by severity.
Where do the CLI and CI fit?
CLI scans upload the SBOM and findings to the platform when you are signed in. That is the better route for pipelines, where you want an SBOM on every build. The Safeguard CLI is the npm package @safeguard-sh/cli and also installs through Homebrew.
What about the iOS and Android apps?
The download page lists an iOS app for iPhone and iPad on the App Store, and an Android app on Google Play for phones and tablets, with a direct APK also offered. It does not call either one beta. It also does not describe generating an SBOM inside the apps, and the SBOM documentation lists the web application, desktop application and local runner as its clients. So treat the phone as a place to sign in and check on things, and do the generation on the web, CLI or CI until the documentation says otherwise.
The Android angle that is documented is different: the platform can scan an Android APK file that you upload. That scans the app you are building, which is a separate question from which Safeguard app you use.
What should you check in the result?
Open the project and look at three things. First, whether the component count looks plausible for the repository. A tiny list for a large service usually means a manifest was missed. Second, whether dev dependencies were included or excluded on purpose. Third, the findings by severity, so you know where to start.
Keep the SBOM with the release it describes. If a customer or auditor asks later what was in a version, you can answer from the record.
What to do
- Pick one repository and generate its SBOM from Integrations.
- Check the component count against what you expect.
- Decide whether dev dependencies belong in the report.
- Run the same repository through the CLI and compare.
- Add the CLI step to CI so each build produces an SBOM.
- If you ship an Android app, upload the APK as a separate scan.
- Store the SBOM with each release.
Quick check
Can I generate an SBOM from the iPhone app?
The documentation we checked does not describe it. Use the web platform, CLI or CI, which are documented.
Can Safeguard scan an Android app?
The SBOM documentation lists an option to upload and scan Android APK files in the platform.
Sources
Last reviewed: 18 October 2026.
