In the Safeguard web app, you generate an SBOM by connecting a repository under Integrations, then you read it by asking the search chat plain questions such as which components carry GPL licenses or which packages a CVE affects. Generation uses the Integrations page. The chat is for reading and following up.
This guide follows Safeguard's documentation. We note where the docs describe the chat's role so you know which steps are clicks and which are questions.
How do you generate the SBOM?
- Sign in at app.safeguard.sh and open Integrations from the sidebar.
- Choose a source. The docs list source code management options (GitHub, GitLab, Bitbucket and generic Git), container registries, AI model sources, and file uploads, including package manifests such as package.json and requirements.txt.
- Click Connect on the card, give the configuration a name, and enter the repository details. Private repositories need credentials, which you verify before continuing.
- Review the repositories you want, set the branch or tag, the project name and the version.
- Click Connect. Your configuration appears in the Project Configurations table, and the project shows in Projects.
Generation options in the docs include the branch or tag, whether to include development dependencies, and a deep analysis switch. Time depends on size: the docs say under a minute for fewer than 100 dependencies, two to five minutes for 100 to 500, and five to fifteen minutes beyond that.
If you prefer to keep source on your machine, the Safeguard CLI builds an SBOM locally. The docs say the scan runs on your machine and only the SBOM and findings are uploaded when you scan from the signed-in terminal.
Open the dependency inventory demo in its own page.
How do you read it by hand first?
Click the project in Projects to open the Project Overview. The docs describe tabs including Info, Attestation, Dependencies, Provenance, Vulnerabilities, Mitigations, Security Posture and Suppliers and Licenses. The Dependencies tab has a tree view, which shows parent and child relationships and depth, and a table view with component, license, vulnerability count and last updated date. The Vulnerabilities tab shows fix recommendations and an AI Remediate button.
How do you read it with the chat?
Open the search page and ask. The docs say you need no query syntax. Examples from the docs:
- "Show me all critical vulnerabilities in production"
- "Find components with GPL licenses"
- "What packages are affected by Log4j?"
- "Show outdated dependencies in the payments service"
A few input shortcuts help. Typing @ opens a picker to scope a question to a specific project, and typing a colon lets you reference a specific component or vulnerability. Follow-ups keep context, so after the first answer you can ask "Which of these are exploitable?" and the chat narrows the list. Results are grouped as components, vulnerabilities and projects, with fields such as version, license, CVE and fix availability. You can star a conversation you will want again, such as a weekly review.
How do you check the SBOM itself?
An SBOM that is wrong is worse than none. Compare the component count with your lockfile. If you have an SBOM from another source, the CLI has a validate command for CycloneDX, SPDX and VEX documents:
safeguard validate sbom.json --strict
The docs say strict mode treats warnings as errors. Use it to catch missing fields before you share the file with a customer.
What are the limits?
The chat answers from your Safeguard data, so it can only describe projects you have connected. Whether the chat can start an SBOM generation by itself is not stated in the docs we read, so treat generation as an Integrations task. Natural language filters can be misread, so check the filter the chat applied before you export a list. And an SBOM is a snapshot: regenerate after a release.
What to do
- Connect one repository under Integrations and wait for the project to appear.
- Open the project and compare the Dependencies tab with your lockfile.
- Ask the chat for components with licenses you restrict.
- Ask which components are affected by a CVE you care about, then ask which are exploitable.
- Star the conversation you want to repeat.
- Validate any SBOM you plan to share outside the company.
Quick check
Can I generate an SBOM just by asking the chat?
The docs describe generation through the Integrations page. The chat is documented for searching and following up on your data, so use Integrations to generate.
How long does SBOM generation take?
Per the docs, under a minute for fewer than 100 dependencies, two to five minutes for medium projects and five to fifteen minutes for large ones.
Sources
- Safeguard docs, Generate SBOM
- Safeguard docs, Explore SBOM
- Safeguard docs, Search
- Safeguard docs, CLI usage
Last reviewed: 18 October 2026.
