How do I get started with Safeguard in my first hour?

In your first hour with Safeguard, create an account, connect one source code repository, add it as a project, wait a few minutes for the first scan, read the results by severity, and review one fix by hand. Leave automatic fixes on Manual until you have seen how they behave.

TL;DR

• A new workspace starts empty. Your first job is to connect code.
• Connect one repository, not all of them. Learn on a small one.
• The first scan takes about one to five minutes, depending on project size, per the Safeguard docs.
• Read findings by severity and by whether your code can reach them.
• Fix one thing by hand. Keep automatic fixes on Manual until you trust them.

Definition: A workspace is your team's own space inside Safeguard. It holds your connected repositories, your projects, your findings and your settings. A project is one repository or image that Safeguard scans.

What should I do before I start?

Spend five minutes on this checklist. It will save you trouble later.

• Pick one repository. Choose something real but small, and a codebase you know well. You will recognize if the results look right.
• Check who can authorize access. Connecting a repository usually needs permission from someone who owns it. Find that person first.
• Decide if you want to try without real code. The Safeguard download page lists a cloud sandbox, hosted by Safeguard, with a seeded demo repo, free for seven days with no card. You can use it to look around before connecting anything. The free scan at gold.safeguard.sh/scan also needs no account.
• Tell your team. A surprise scan on a shared repo is no fun for anyone.

If you want a quicker, lighter first look, our post on running a free dependency scan takes about five minutes.

How do I sign up and set up the workspace? (minutes 0 to 10)

The getting started documentation describes the steps:

1. Go to safeguard.sh and choose Try for Free. Enterprise teams can choose Book a Call instead.
2. Enter your work email, name, organization and a password.
3. Check your inbox and click the verification link. Your account becomes active.
4. Complete your profile (job title, team size, main use case, time zone).
5. Set your organization name and industry, and choose which Safeguard products to enable.

Single sign on (SSO) is optional. SSO lets people use their company login instead of another password. If you are only trying Safeguard, skip it. If you are setting up for a team, the docs list it as a step you can complete before you invite people.

To bring in teammates, go to Settings, then Members, and choose Invite Member. The docs list three roles: Tenant Admin (full admin access), Manager (manage projects, users and security settings) and User (standard access to view and work with projects). Give people the lowest role that lets them do their job.

How do I connect my code? (minutes 10 to 20)

The onboarding documentation says to connect integrations first. An integration is a link between Safeguard and another tool you use.

1. Go to Settings, then Integrations.
2. Click Connect next to your provider. The docs list GitHub, GitLab, Bitbucket, Azure Repos and AWS CodeCommit for source code, and Docker Hub, AWS ECR, Google GCR and Azure ACR for container registries.
3. Authorize Safeguard when the provider asks.
4. Select which repositories to monitor. Pick only the one you chose earlier.

Be deliberate about step 4. It is tempting to select everything. Do not. A single repo means a short result list and an easier review. You can add the rest in week two.

If your code must stay on your own machines, there is another path. The Safeguard CLI scans a folder on your computer and uploads only results, never source code. See our CLI install guide.

How do I run the first scan? (minutes 20 to 30)

Add the repository as a project:

1. Go to Projects and click Add Project.
2. Choose the integration source and the repository (or image).
3. Set the project details, such as the branch and version.
4. Click Add Project.

The project appears in the Projects table with its name, version, status and a count of findings by severity. The docs say generation typically takes one to five minutes depending on project size. Use that time to get a drink.

While you wait, remember what is happening. Safeguard builds an SBOM, a software bill of materials. That is a complete list of the packages in your project, including indirect ones. It then compares that list with known vulnerabilities. A vulnerability is a flaw that someone has publicly reported, usually with a CVE ID.

How do I read the results? (minutes 30 to 45)

Open the project. The docs describe an overview with charts for findings by severity and supply chain risk by component, plus tabs for dependencies, vulnerabilities, mitigations, security posture and suppliers and licenses.

Take it in this order:

The Safeguard guide to getting started frames the goal as seeing which finding matters. You do not need to understand all of them. You need to pick one. Our post on what to fix first gives a five question order for that.

How do I fix one thing? (minutes 45 to 60)

Choose one high severity finding with a fixed version. Then decide: by hand, or with the fix feature.

The onboarding docs describe the fix flow. Open the Vulnerabilities tab in a project, click the AI Remediate button, review the proposed fix, and then click Create Pull Request. You stay in charge of each step. That is the pattern we suggest for your first one.

A pull request is a proposed code change that a teammate reviews before it joins the main code. Read it. Run your tests. Ask a teammate to approve it. Our guide on fixing your first vulnerable dependency safely gives the full routine.

What about turning on automatic fixes?

The docs also describe an automatic option under Settings. It lets Safeguard create pull requests for you. Our advice for hour one is simple: do not turn it on yet.

The Safeguard remediation demo says that everything starts off and set to Manual until an admin turns it on. In Settings, under Automation, an admin picks a strategy for vulnerabilities and for eight other kinds of plans, and decides which ones run automatically. The fixes demo says AI Remediate ships turned off.

So you will not see surprise pull requests. When you are ready, review several by hand first, then turn on one category and watch it for a while.

What does the first hour look like with invented numbers?

The numbers below are invented to show the shape of a session.

At the end of the hour you have one connected repo, a list of real findings, one fix in review, and no automation surprises. That is a good first hour.

What should I do in week one after that?

• Day 2: Add one more repository.
• Day 3: Invite one teammate and review a finding together.
• Day 4: Try a policy in warn mode. Our post on how to set up a vulnerability policy gate shows how.
• Day 5: Add scanning to your pipeline. See our CI pipeline guide.

Also consider which other surfaces fit your team. Our guide to choosing a Safeguard surface compares the desktop app, editor extensions, browser, phone and chat.

How can Safeguard help along the way?

Safeguard offers these generally available capabilities that you will meet in week one and after: SBOM and dependency scanning, reachability analysis, policies, gates and guardrails, asset discovery, zero day discovery, compliance and evidence automation, and autonomous remediation with fix pull requests (off by default, every category on Manual). For teams working with AI assistants, MCP Guardrail and agent identity are also available.

The Safeguard CLI is worth a look too. It runs on your machine, and its assistant can write code as well as explain findings, asking first before it changes files.

Try it yourself

Click through it at your own pace, or open it full screen.

Click through the eight steps and look for the Settings, Automation page, where every category starts off and on Manual.

Quick check

Sources

• Getting started documentation
• Create an account
• Onboarding workflow
• Getting started with Safeguard demo
• Remediation strategies demo
• Fixes available now demo
• Safeguard download page
• Safeguard Gold, Free Dependency Scan

Last reviewed: 19 October 2026.