Give developers the same scanner the pipeline uses, available in three places: the editor, a command line tool, and the pull request. When the local result matches the pipeline result, developers fix issues early and stop treating the gate as a surprise.
The three self service surfaces
| Surface | Speed | Best for | Limit |
|---|---|---|---|
| IDE extension | Seconds | Catching issues while typing or on save | Partial view, depends on developer setup |
| CLI | Seconds to minutes | Pre push checks, scripting, same engine as CI | Developers must install and run it |
| Pull request check | Minutes | The authoritative result | Feedback comes after commit |
Each has a different job. Do not try to make the IDE the gate. Make it the early warning, and keep the pull request as the enforcement point.
Keep results consistent
The most common complaint is "it passed on my machine." Avoid it by pinning the scanner version and policy in one place and having the IDE, CLI and pipeline read the same policy. If rules differ by surface, say so in the docs and keep the difference small.
Steps to launch
- Choose the supported install routes and document them in one page.
- Publish a one line command developers can paste, such as a scan of the current directory.
- Add a pre push hook as an option, not a requirement. Mandatory hooks get bypassed.
- Make findings explain themselves: package, version, fixed version, and whether the code path is reachable.
- Link each finding to a fix action, ideally an automated pull request.
- Ask five developers to try it and watch where they get stuck.
Reduce friction
Local scans should be fast and quiet. Cache results, scan only changed manifests where possible, and avoid dumping hundreds of low severity lines. Hide what a developer cannot act on.
Support model
Name an owner for developer experience of security tools. Track questions in a channel and fix the top three confusing messages each month. Treat the scanner like any internal product with users.
Try it yourself
Open the fix demo to see what a developer sees when a fix is available, and how a suggested change is presented.
Click through it at your own pace, or open it full screen.
Quick check
Should the pre push hook be mandatory?
Usually not. Local hooks are easy to skip and annoy people. Enforce at the pull request, and offer the hook as a convenience.
Can local and pipeline results differ?
They can, if versions or policy differ. Pin both to the same version and policy to keep them aligned.
Safeguard ships a CLI, plugins for VS Code and JetBrains, and a free web scan at gold.safeguard.sh/scan, so developers can check code before they open a pull request.
Last reviewed: 19 October 2026.
