How do I add security scanning to VS Code or JetBrains?

To add security scanning to your editor, install the Safeguard extension from the VS Code Marketplace, Open VSX (for Cursor and similar editors), or the JetBrains Marketplace. Run the Safeguard login command, approve the sign in on the web, and open a project. Vulnerable dependencies are flagged inline as you work.

TL;DR

• Safeguard has an extension for VS Code and a plugin for JetBrains IDEs. Open VSX covers Cursor, Windsurf, Codium and compatible editors.
• Sign in with a short code in your browser. You do not type a tenant ID.
• The extension reads your dependency files and marks risky packages in the editor.
• You can ask it for a fix, choose how bold the fix should be, and review the change before you accept it.

Definition: An IDE (integrated development environment) is the program where you write code, such as VS Code or IntelliJ. An IDE extension adds a feature to it. A security extension adds warnings about risky code or packages while you type.

Why scan inside the editor instead of later?

Fixing a problem is cheapest when the code is still open in front of you. You remember why you added that package. You know which file uses it. The change is small.

If the same problem shows up three weeks later in a report, you must find the code again, remember the reason, and ask whether the fix will break something. The same fix now costs more.

An editor scan works like spell check. It underlines the problem while you type, so you fix it before you send the message.

This does not replace the other checks. A scan in a build pipeline still matters, because people forget to look and some code arrives from other people. But the editor scan catches the easy ones early.

Which editors does it work with?

The Safeguard download page and documentation list these:

The documentation says the VS Code extension needs VS Code 1.85 or newer. The JetBrains plugin needs a 2023.3 or newer IDE and Java 17 or newer. The two are built and versioned separately, so features differ a little between them. Where that matters, this post says so.

How do I install it?

For VS Code, open the Extensions panel (Ctrl+Shift+X on Windows and Linux, Cmd+Shift+X on macOS), search for "Safeguard", and click Install. You can also use the command line:

code --install-extension Safeguard-sh-Inc.SafeguardshIdeExtension

For Cursor, the same package installs through Open VSX:

cursor --install-extension Safeguard-sh-Inc.SafeguardshIdeExtension

For JetBrains, open Settings (or Preferences), then Plugins. Search for "Safeguard", click Install, and restart the IDE. If your company blocks the marketplace, you can download the plugin file and install it from disk using the gear icon.

How do I sign in?

Signing in uses a pattern called the device flow. It means the editor never sees your password.

1. Run Safeguard: Login. In VS Code and Cursor it is in the Command Palette. In JetBrains use Tools, then Safeguard, then Login.
2. A browser tab opens at the Safeguard activation page and shows a verification code.
3. Sign in there and approve the device.
4. Go back to the editor. Your tenant (your company account) is filled in for you, and your tokens are kept in the editor's secure credential storage.

The code expires after a set time. The documentation says 10 minutes for the extension. If you wait too long, run Login again.

If your editor opened the wrong browser profile, you can copy the link from the notification and open it where you are signed in. Approving it there finishes the sign in back in the editor.

The documentation also says that scanning public packages works without logging in, while some features that depend on the backend need you to sign in.

What does it scan?

It scans the dependency files in your project. It does not scan every line of your own code. The supported files are:

In VS Code and Cursor, simply having one of those files in your workspace turns the extension on. Both the auto scan and scan on save settings default to on. You can also scan on demand. In VS Code, open the Command Palette and run Safeguard: Scan Project for Vulnerabilities. In JetBrains, right click a manifest file and choose Safeguard, then Scan File for Vulnerabilities, or use Tools, then Safeguard, then Scan Project.

How do I read what it shows?

In VS Code, hover a flagged dependency to see a short summary. Open the Safeguard view in the activity bar for panels covering vulnerabilities, the SBOM (software bill of materials, the ingredient list of your project), compliance, and recommendations. You can export a report from a panel when you need to hand findings to someone else.

In JetBrains, a Safeguard tool window at the bottom shows a tree. Expand a package to see its individual CVEs, and double click one for details. Vulnerable lines are highlighted by color: red for critical, orange for high, yellow for medium, blue for low.

A CVE is a public ID for a known flaw. Our post on CVSS, EPSS and KEV explains the scores you will see next to them.

How do fixes work in the editor?

The extension can suggest a fix, and you choose how bold the fix should be. There are three strategies:

A version number usually has three parts, like 4.17.21. A patch update changes the last part and should only fix bugs. A minor update changes the middle part and adds features without breaking old ones. A major update changes the first part and may break things. That is why the more aggressive choice carries more risk.

In VS Code, hover a flagged dependency, open the lightbulb menu with Ctrl+. (or Cmd+. on a Mac), and pick a suggested fix. In JetBrains, put the cursor on the flagged dependency, press Alt+Enter, choose Fix with Safeguard AI, pick a strategy, and review the change in the diff view before applying it. A diff view shows the old and new lines side by side.

You can also set a default strategy in your VS Code settings:

{
  "safeguard.remediationStrategy": "safe"
}

VS Code and Cursor also include a chat panel where you can ask questions in plain language, such as "Why is this package vulnerable?"

What does a morning with the extension look like, with invented numbers?

Here is a pretend morning. The numbers are invented.

You open a Node project with 180 packages. The extension flags 6 of them. Two are marked high. You hover the first one. It says a patch release fixes it. You choose the Safe strategy, accept the fix, and the diff shows one line changed in package.json.

The second high item only has a fix in a new major version. Safe strategy does not offer it. You note it in your tracker, ask the chat panel what would change in that major release, and plan a proper upgrade for later in the week.

Result: one problem gone in a minute, one problem understood and scheduled. Neither needed a meeting.

How can Safeguard help beyond the editor?

The editor view is one slice. The generally available Safeguard platform adds:

• SBOM and dependency scanning across all your repositories.
• Reachability analysis, which checks whether your code actually uses the vulnerable function.
• Policies and gates, which can stop a risky pull request.
• Autonomous remediation with fix pull requests, which is off by default, with every category set to Manual until an admin turns it on.

The Safeguard CLI is another way in. It runs on your machine, and its assistant can also write code to apply a fix. See our CLI install guide. For a first look at your dependencies without installing anything, try the free scan at gold.safeguard.sh/scan.

Try it yourself

Click through it at your own pace, or open it full screen.

Look for how upgrades are grouped into compatible, minor and major, and which ones are marked as likely to break your code. That is the same trade off the strategy setting controls in your editor.

Quick check

Sources

• Safeguard download page
• IDE support documentation
• Fixes available now demo
• Safeguard Gold, Free Dependency Scan

Last reviewed: 19 October 2026.