Safeguard gets an SBOM into the platform two ways. It can generate one from a source you connect, or you can import one that another tool or a vendor produced. After that, both are treated the same: matched to vulnerabilities, scored and monitored.
Generating an SBOM
Open Integrations in the sidebar. You can filter the cards by All, Source Code (SCM), Container Image, AI Model or Upload.
| Type | Examples listed in the docs |
|---|---|
| Source code | GitHub, GitLab, Bitbucket, generic Git URL |
| Container images | Amazon ECR, Docker Hub, GCP Cloud Source, OCI registries |
| AI models | Hugging Face |
| Uploads | CSAF or VEX files, Android APK files, package manifests such as package.json and requirements.txt |
The docs walk through Bitbucket as the example. Click Connect on the card, choose Public or Private, name the configuration, and enter a repository URL or credentials. For private repositories you click Verify Credentials, choose a workspace, then review the repositories. For each one you set the branch or tag, the project name and the version, then click Connect. The result shows up under Projects.
Generation options include project name, version, branch or tag, whether to include dev dependencies, and Deep Analysis, which turns on Griffin AI analysis. Scans can run daily, on push, on a schedule or on release.
Generating from your terminal
The CLI builds an SBOM on your machine and sends only results to the platform.
curl -fsSL https://cli.safeguard.sh/install | bash
safeguard
# then type /login and /scan .
safeguard scan --dir .
Results are written under an output folder. Your source stays on the machine.
Importing an existing SBOM
Click Connect on the Upload SBOM card, enter a name, version and optional description, pick SPDX or CycloneDX (auto-detected if you leave it blank), then drag in the file or click Browse. The page lists .json, .xml, .spdx and .rdf files up to 100MB. Review the detected format and component count and click Upload SBOM.
Supported formats per the docs: CycloneDX 1.3 to 1.6 in JSON and XML, and SPDX 2.2 and 2.3 in JSON, tag-value and RDF. Syft and Trivy JSON are converted to CycloneDX, and Grype JSON has its vulnerability data imported.
What happens after upload
- Validation. Format compliance, schema validation, required fields and component data quality.
- Enrichment. CVE matching, EPSS scores, CISA KEV status, license information and supplier data.
- Analysis. Griffin looks at attestation scoring, risk scoring, reachability and dependency health.
Uploaded SBOMs are then monitored. The docs list daily scans, KEV updates, dependency updates and license changes. You can also check quality metrics such as completeness and PURL accuracy, and export a project in another format from the Export button.
The CLI will not upload an imported SBOM for you. It can validate one and scan one locally:
safeguard validate sbom.json
safeguard scan --sbom sbom.json
Practical advice
Ask vendors for CycloneDX or SPDX in JSON with name, version and a package URL for each component. Without PURLs Safeguard still tracks a component but cannot enrich it. Record where each SBOM came from and check signatures when they exist.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the CLI upload an imported SBOM to the platform?
No. Upload imported SBOMs through the UI. The CLI can validate and scan one locally.
