How Smart Glasses Are Made: Cameras, Mics, Displays, Firmware, Privacy

Smart glasses are made by moulding a frame and temples, routing flexible circuits through the hinges, and fitting a small camera, several microphones, open ear speakers, a battery and a low power system on chip (SoC) into the front and arms. Display models add a tiny projector and a waveguide in one lens. A white capture light tells bystanders when the camera is recording.

That light is the hinge of the whole privacy debate. Ireland's Data Protection Commission questioned in 2021 whether a "very small indicator light" was enough notice, and in July 2026 Meta said its glasses now disable the camera when the light is blocked or tampered with. Everything else in this post, from the waveguide to the companion app, explains how the parts get there and what data they produce.

This post goes one level deeper than our builds of a smartwatch, a smart speaker and a VR headset. For the sensor inside the camera, read how camera image sensors are made. For what happens when someone runs face matching on footage, read facial recognition explained.

Key takeaways

• Smart glasses are nine subsystems packed into a frame that has to feel like ordinary eyewear.
• Device families: audio glasses (no camera), camera glasses, and display glasses with a small in lens screen. Wide field AR glasses are still mostly prototypes.
• A display model needs a projector and a waveguide. iFixit's teardown of Meta Ray-Ban Display found a 600 by 600 pixel liquid crystal on silicon (LCoS) projector in the right arm and a geometric, mirror based waveguide in the right lens.
• The compute is a wearable class SoC. Meta says Ray-Ban Meta (2023) runs on Qualcomm's Snapdragon AR1 Gen 1; iFixit found the same chip family with 2 GB of RAM and 32 GB of flash in the Display model.
• Software is split across glasses firmware, a companion phone app and cloud AI; Android XR glasses apps run on the phone and are "projected" to the glasses.
• Bystander notice depends on firmware rules around the capture LED. Snap's Spectacles also blink the LED while a published Lens captures camera, microphone or location data.
• In the EU, the GDPR household exemption is narrow and the AI Act bans certain biometric practices.
• Safeguard does not analyse glasses hardware or firmware. It fits the companion apps, Android XR projected apps and back ends that teams build around glasses.

What are the main subsystems of smart glasses?

A phone has room for a camera bump, a big battery and a heat spreader. A glasses frame has a few cubic centimetres split between a front and two arms, all of it touching skin and all of it in plain view of the person you are talking to. So the parts are shrunk, split across both arms and joined by flexible circuits that run through the hinges.

Why the subsystems fight each other

Weight sits on the nose bridge, so every gram added to the front makes the frame slide. Heat matters because the SoC is a few millimetres from the side of your head. Radio matters because Bluetooth and Wi-Fi antennas have to fit in a narrow arm, right next to the skull, which absorbs radio energy. And the camera and LED have to look like a style detail rather than a gadget, which pulls against regulators who want the LED to be obvious.

So the battery goes in the arm opposite the SoC, speakers are soldered rather than connected, and arms are glued shut for splash resistance (IPX4 on the Display model, which iFixit says hardly needs that much glue).

What is the difference between audio, camera and display glasses?

At device level, the difference is how many of three jobs the glasses take on: sound, capture and showing you something.

Audio glasses

Audio glasses have speakers, microphones, a battery and a Bluetooth radio, and nothing else that touches privacy beyond the microphones. Meta introduced Ray-Ban Meta Audio on 23 September 2026 and calls it its "first-ever audio glasses": 43 grams, up to 12 hours on a charge and up to 48 more from the case, according to Meta. Google's Android XR docs use the same category name, "audio glasses", for devices that offer experiences "through voice" without a display.

Camera glasses

Camera glasses add the camera module and the capture LED. This is the category most people mean by "smart glasses": Ray-Ban Stories in 2021, Ray-Ban Meta from 2023, and later generations. Feedback reaches you through sound, a touchpad on the arm and the LED, so the optics are just ordinary lenses: clear, tinted, photochromic or prescription.

Display glasses

Display glasses add an optical engine that puts light into your eye. Meta's announcement of Meta Ray-Ban Display on 17 September 2025 describes a full colour display "placed off to the side" and "designed for short interactions", controlled by an electromyography (EMG) wristband called Meta Neural Band. Meta now sorts its range into "camera AI glasses", "display AI glasses" and "augmented reality glasses", the last being prototypes such as Orion with a large holographic display.

Google's Android XR docs note that only display glasses have a display an app can draw on, and because the optics are additive, they tell developers to use a pure black background so unlit pixels leave the real world clear.

How a waveguide works

A waveguide is a thin slab of glass inside the lens. A projector fires an image into one edge. Light travels along the slab by total internal reflection, the way it travels along an optical fibre. Structures inside or on the slab let a small share of the light escape toward your eye at each bounce, which spreads the image over an area called the eyebox, so it stays visible when the frame shifts on your nose.

There are two main families:

• Diffractive waveguides use nanoscale gratings on the glass surface to bend and split light. iFixit notes the side effects: light splits in directions you do not want, causing "eye glow" visible to people across the table and rainbow artefacts when overhead light catches the gratings.
• Geometric (reflective) waveguides use rows of tiny partially reflective mirrors buried in the glass. In the Meta Ray-Ban Display teardown, iFixit describes a rectangular mirror at the top right of the lens that sends light down into vertical "pupil expander" slats, which then send it across horizontal partially reflective mirrors. iFixit says the glass is made by stacking coated glass layers, cutting them on a diagonal with a diamond wire saw and grinding them very precisely, and that "someone sitting across from you won't see any evidence of the screen".

Tethered "screen glasses" often use birdbath optics instead: a beam splitter and curved partial mirror that are simpler and bright but thicker and darker than a waveguide.

The projector: LCoS, microLED or micro OLED

In iFixit's teardown, light from three LEDs passes through a homogeniser (a tiny lens array that blends the colours), reflects off the 600 by 600 LCoS panel, then goes through lenses, mirrors and a polarising beam splitter into the waveguide.

Worked example 1: why waveguide projectors must be so bright

A waveguide passes only a small share of the projector's light to the eye. Take an illustrative projector output of 1,000,000 nits into the waveguide and an end to end efficiency of 0.5 percent: 1,000,000 x 0.005 = 5,000 nits reach your eye. Halve the efficiency to 0.25 percent and you get 2,500 nits, which can wash out on a sunny pavement. These numbers illustrate the method only; real efficiencies are rarely published. The point is that waveguides demand very bright light sources.

How is the camera module built?

The camera is a phone style module made smaller. A stacked CMOS image sensor (made the way our image sensor post describes) sits under a short stack of moulded plastic lens elements and an infrared cut filter, inside a barrel a few millimetres wide. It connects to the main board by a flexible printed circuit.

There is little room for optical image stabilisation, so footage is usually stabilised electronically: the image signal processor (ISP) crops and shifts each frame using data from the inertial measurement unit. Ultra wide lenses help because small head movements look smaller in a wide frame. Meta has described its 2023 camera as "ultra-wide 12 MP" with 1080p clips "up to 60 seconds", and its 2026 Gen 3 as 12 MP with "3K Ultra HD video recording". The 2021 Ray-Ban Stories used "dual integrated 5MP cameras" and clips up to 30 seconds.

Where the capture LED fits

The capture LED sits on the front near the camera. Meta's 2021 launch post said it was "hard-wired" to light when a photo or video was taken. Meta's July 2026 explainer says the LED blinks briefly for a photo and keeps blinking for as long as a video records, that its brightness was tested to be visible in daylight, and that there is a shutter sound the wearer can hear but which is "simply not practical" to make audible at a distance. We return to the tamper rules in the bystander section.

How do the microphones and speakers work?

Microphone arrays

Smart glasses use micro electro mechanical systems (MEMS) microphones: a tiny silicon membrane and backplate etched on a wafer and sealed in a package with an acoustic port. Placing several around the frame lets the SoC compare when sound arrives at each one and steer a "beam" toward the wearer's mouth, which sits in a fixed place relative to the frame. Meta's 2021 post credits "beamforming technology and a background noise suppression algorithm" for call quality; its 2023 post says the five microphone array supports "immersive audio recording"; its 2026 post says the Gen 3 six microphone array "cuts more than 90% of background noise".

Worked example 2: arrival time across a frame

Sound travels at about 343 metres per second at 20 degrees Celsius. Take two microphones 14 centimetres apart. The largest possible arrival time difference is 0.14 / 343, or about 0.41 milliseconds. At a 16 kHz sample rate that is 0.000408 x 16,000, about 6.5 samples; at 48 kHz it is about 19.6 samples. Beamforming delays and sums the channels by fractions of those sample counts so that sound from one direction adds up and sound from others partly cancels.

The wearer's mouth is always in the same place, so those delays can be fixed per frame design. The same array also hears people nearby, which makes microphones a bystander question too.

Open ear speakers

Small dynamic drivers in the arms point toward the ear canal without sealing it, so you still hear traffic and conversation. Meta's 2023 post describes directional audio with "reduced audio leakage" to people nearby. iFixit notes that in the Display model the speakers are soldered in rather than clipped, so a speaker failure means "major surgery".

What SoC runs smart glasses, and how do they connect?

Glasses run wearable class SoCs that bundle CPU cores, an ISP, an audio DSP, a neural processing unit for small on device models, and Bluetooth and Wi-Fi radios. Meta's 2023 launch post says Ray-Ban Meta is "powered by the all-new Qualcomm Snapdragon AR1 Gen1 Platform". iFixit found "the Snapdragon AR1 chipset, paired with 32 GB of flash storage and 2 GB of LPDDR4X RAM" in the right arm of Meta Ray-Ban Display, with the battery, microphones and speakers in the left arm.

Many designs add a small always on processor that listens for the wake word while the main chip sleeps.

Connectivity is typically Bluetooth Low Energy for pairing and control, and Wi-Fi for moving photos and video to the phone quickly. Heavier AI work, such as answering a question about what the camera sees, usually travels from the glasses to the phone and then to the vendor's cloud.

What powers smart glasses?

A small lithium cell shaped to the arm powers the glasses; the case carries a larger cell that tops them up.

Worked example 3: what the battery numbers mean

iFixit measured a 960 mWh battery in Meta Ray-Ban Display, and Meta quotes "up to six hours of mixed-use battery life". Average power is energy divided by time: 960 mWh / 6 h = 160 mW. For comparison, if continuous video capture and display drew, say, 1,000 mW (an illustrative figure, not a measurement), the same cell would last 960 / 1,000, about 58 minutes. That is why clip lengths are capped and the display is "designed for short interactions".

Case numbers read the same way. Meta says the 2023 case holds "up to eight additional charges (for a total of 36 hours of use)": nine charges in all, so about 36 / 9 = 4 hours per charge.

How are smart glasses made, step by step?

The table below follows a camera or display model from raw materials to a boxed product. Exact processes differ by vendor; the steps are the general industry pattern, with teardown observations where we have them.

Why calibration is per unit

Every camera module, MEMS microphone and projector to waveguide alignment differs slightly. Factory software measures each unit and stores correction values in flash for the life of the device, so firmware updates must preserve them.

What teardowns say about repair

iFixit's verdict on Meta Ray-Ban Display was blunt: "Don't count on fixing them." The arms are glued, the battery sits on adhesive, replacement batteries were not on sale when iFixit published on 8 October 2025, and the waveguide lens is unlikely to be replaceable. iFixit also points out that photochromic lenses lose effect over time. In practice the life of the glasses is the life of the battery.

What software runs on smart glasses?

The software stack has three layers, and most of the code that touches your data is not on the glasses.

Firmware on the glasses

The glasses run an embedded operating system that drives the camera pipeline, audio, radios, touch and the LED. It also enforces device rules such as Meta's "no photos or videos can be taken until we detect that the light is unblocked". These rules live in firmware, which is why the version you run matters.

The companion phone app

Most camera glasses cannot be set up without a phone. The companion app pairs over Bluetooth, signs you in, imports media, delivers firmware updates and holds settings for AI features and data sharing. Meta's 2021 launch paired Ray-Ban Stories with an app called Facebook View that imported, edited and shared captures. Meta's July 2026 explainer says photos and videos are "stored privately on your glasses" until you choose to import them to your phone.

Cloud AI

When you ask an assistant about what you are looking at, a frame or short clip plus your voice query goes from the glasses to the phone and on to the vendor's cloud. Meta Ray-Ban Display adds visual answers and step by step instructions on the display, live captions and translation, and pedestrian navigation, according to Meta's launch post. Each of those is a cloud call with its own data handling.

Platforms: Android XR, Snap OS and OpenXR

Android XR. Google announced Android XR on 12 December 2024 as "a new operating system built for this next generation of computing", made with Samsung and Qualcomm, and said glasses would follow headsets. Google's developer docs now cover "audio glasses and display glasses" and describe a distinctive model: the activity you build for glasses "doesn't run directly on the device, but is instead projected to the device from a host device (such as user's phone)". Developers build a "projected activity" inside their existing phone app and use a "projected context" so camera, microphone and sensor calls reach the glasses rather than the phone. The docs say glasses permissions are separate and must be requested at runtime "even if it already has the corresponding permissions on the phone". The SDK is in developer preview.

Snap OS. Snap's Spectacles run Snap OS, and apps are Lenses built in Lens Studio. Snap's docs say Lenses that use a capability without declaring the permission "automatically get a permission denied by the SnapOS system", and that APIs exposing camera, microphone or location are tagged "Exposes User Data".

OpenXR. The Khronos Group describes OpenXR as "a royalty-free, open standard that provides a common set of APIs for developing XR applications". Android XR lists OpenXR alongside the Jetpack XR SDK, Unity, Godot, Unreal Engine and WebXR as supported ways to build. On glasses, OpenXR matters most for wired XR glasses and AR glasses that run full 3D apps.

How updates are delivered

Firmware usually downloads through the companion app and moves to the glasses over Wi-Fi or Bluetooth, where it is verified and installed. Meta's 2026 post shows why this matters: the LED tamper rules changed by software update, first disabling the camera when the LED is blocked (beginning with the second generation), then extending to physical tampering. Glasses that never update keep the old rules.

Bystander privacy: the capture LED, tamper rules and regulators

What the LED does, according to vendors

Meta's July 2026 explainer gives the most detailed vendor description we found. Each pair has "a white light called a capture LED"; it blinks briefly for a photo and keeps blinking during video; it "has no off switch". Meta says it chose a white light for "the best combination of visibility and experience" and tested brightness for daytime visibility.

On tampering, Meta says: "Beginning with our second generation of glasses, the camera is automatically disabled if we detect that the capture LED has been blocked." After people moved from tape to "sophisticated efforts to modify or destroy" the LED, Meta says it is "updating the glasses to disable the camera if they detect the LED was physically tampered with or destroyed". It also says it acts against sellers of tampering services.

Snap describes a related rule for apps rather than the built in camera. On Spectacles, Lenses could not originally combine internet or Bluetooth connectivity with sensitive data. "Transparent Permission" now allows it with two safeguards: a prompt listing the sensitive data, and "the device's LED blinks while sensitive data is being captured". Snap also documents an "Extended Permissions" user setting that skips those prompts by granting permissions by default, which is worth knowing if you manage a fleet of developer devices.

What regulators have said

On 17 September 2021, a week after Ray-Ban Stories launched, Ireland's Data Protection Commission (DPC) and Italy's Garante issued a joint concern. The DPC noted that a phone is visibly the recording device, whereas "with the glasses, there is a very small indicator light". It said it had not been shown that "comprehensive testing in the field" proved the LED was an effective notice, and called on Facebook Ireland to demonstrate that it works and to run a public information campaign. The DPC page does not record a follow up.

Bystander notice options compared

What data do smart glasses collect, and where is it processed?

The AI path is where images of other people most often leave the device, and on Android XR third party glasses apps live on the phone, so ordinary mobile app hygiene decides how bystander data is handled.

What do laws say about recording people with smart glasses?

Recording in public and private places

Laws differ by country and, in the United States, by state, so check your own jurisdiction. Three broad patterns hold in many places. Taking photos in public spaces is often lawful, though publishing them can raise separate rights. Recording the audio of a private conversation often needs the consent of one or all parties, depending on the jurisdiction. Recording in private places such as homes you do not live in, changing rooms, toilets, medical settings and many workplaces is restricted or prohibited, and employers and venues can set stricter house rules.

GDPR and the household exemption

The GDPR does not apply to processing "by a natural person in the course of a purely personal or household activity" (Article 2(2)(c)). The EDPB says this "household exemption" must be "narrowly construed" for video devices. Its examples are useful for glasses wearers. A tourist who records holiday videos and shows them to friends and family, without making them available to an indefinite number of people, is covered. A mountain biker filming a descent in a remote area for personal viewing is covered. Home monitoring of a fenced garden is covered only if it does not extend "even partially to a public space or neighbouring property".

Read the other way: posting glasses footage of strangers publicly, filming as part of a job, or recording systematically can move a wearer outside the exemption and into GDPR duties. Employers who issue glasses to staff are controllers from day one.

Facial recognition on wearables and the EU AI Act

The European Commission's AI Act page lists the banned practices. Among them: "untargeted scraping of the internet or CCTV material to create or expand facial recognition databases", "emotion recognition in workplaces and education institutions", "biometric categorisation to deduce certain protected characteristics", and "real-time remote biometric identification for law enforcement purposes in publicly accessible spaces". The Commission says the AI Act entered into force on 1 August 2024, prohibitions applied from 2 February 2025, and the Act became applicable on 2 August 2026 with exceptions. The page also says rules for high risk systems in areas including biometrics apply from 2 December 2027, after the "AI Omnibus" amendments that entered into force on 27 July 2026.

For glasses: the real time identification ban targets law enforcement, not a private app, but a consumer face lookup needs a face database, and building one by untargeted scraping is banned. Biometric identification data is also a GDPR Article 9 special category, and emotion recognition glasses in an office or school would hit a ban directly. Our facial recognition explainer covers matching methods and other laws in more detail.

Dated timeline

Step by step: check and tighten smart glasses and the apps around them

For owners, IT teams and developers; none of these steps modify firmware.

1. Update the glasses and the companion app

In the companion app, install any glasses firmware update with the glasses charged and nearby, then update the app itself. Note both versions.

2. Review the companion app's phone permissions (Android)

Make sure you are connected to your own phone and that USB debugging is on only for this task. Confirm the device first, then list permissions. Replace the package name with the one your companion app uses.

# confirm which device you are talking to
adb devices -l

# find the companion app package
adb shell pm list packages | grep -i -E "glasses|meta|spectacles|xr"

# show version and granted runtime permissions
adb shell dumpsys package com.example.companion | grep -E "versionName|granted=true"

# show app ops (background location, microphone and so on)
adb shell appops get com.example.companion

3. Revoke what you do not need

# example: remove precise location from the companion app
adb shell pm revoke com.example.companion android.permission.ACCESS_FINE_LOCATION

On iPhone, open Settings, find the companion app, and review Location, Microphone, Camera, Bluetooth, Local Network and Photos. Choose "While Using" over "Always" for location, and limited photo access if the app offers it.

4. Turn off what you do not use in the companion app

Turn off unused automatic media backup, voice recording storage, camera based AI and diagnostics sharing. Delete captures from the glasses after import.

5. For Android XR developers: request glasses permissions only when needed

Google's docs say glasses permissions are separate from phone permissions. Declare only what you use in the manifest, and request at runtime from the projected activity when the feature starts. The manifest entry is the same as on a phone:

<manifest>
    <!-- Only declare permissions that your app actually needs -->
    <uses-permission android:name="android.permission.CAMERA"/>
    <application>
    </application>
</manifest>

From a projected activity, the docs use ProjectedActivityCompat.requestPermissions:

ProjectedActivityCompat.requestPermissions(
    this@PermissionsFromProjectedActivity,
    arrayOf(Manifest.permission.CAMERA),
    CAMERA_PERMISSION_REQUEST_CODE,
)

Google's docs also note that the system's permission instructions are not currently audible on the glasses, so plan an audible rationale (for example with text to speech) before you ask.

6. For Spectacles developers: declare permissions and plan for the LED

Check the Spectacles section of Project Settings in Lens Studio for declared permissions. If your Lens combines internet access with camera, microphone or location, expect Transparent Permission: a prompt and a blinking LED. Snap says unsupported combinations cannot be published.

7. Produce an SBOM for the companion app and its back end

Glasses features ship through phone apps and cloud services, which pull in open source libraries. From the root of your app or service repository:

safeguard scan --dir .
ls ./output

For a containerised back end, scan the image you deploy:

safeguard scan --image registry.example.com/glasses-api:1.4.2

CISA's 2026 Minimum Elements for an SBOM describe what a software bill of materials should contain; use them as the checklist when you share SBOMs with customers.

8. Gate releases on what you find

Set a policy that blocks a release when the companion app or back end carries a known critical vulnerability with a fixed version available, and route exceptions through a named approver. A gate with Block, Warn and Notify actions, and approval through exceptions, keeps the rule strict without freezing a release when a fix is not yet possible.

Common mistakes

• Covering or disabling the capture LED. It removes the main notice to people around you. On Meta's second generation and later glasses, Meta says it also disables the camera, and physical tampering can now disable it until fixed.
• Auto uploading everything to the cloud. Automatic import plus cloud backup sends every clip of every bystander off the device. Import only what you mean to keep.
• Wearing camera glasses in sensitive workplaces. Hospitals, labs, data centres, trading floors, schools and secure sites often ban cameras. Audio glasses or a plain pair are the right choice there.
• Ignoring companion app permissions. The phone app may hold location, contacts and media access that the glasses never needed.
• Skipping firmware updates. Tamper detection and privacy rules arrive in firmware. An old pair runs old rules.
• Assuming the household exemption covers posting. The EDPB reads it narrowly; posting strangers publicly or filming for work can bring GDPR duties.
• Asking for every sensor permission at install time (developers). Android XR treats glasses permissions separately, and users decide better when a feature asks at the moment it needs the sensor.

FAQ

How are smart glasses made?

A frame and arms are moulded with cavities, flexible circuits are routed through the hinges, and a camera module, MEMS microphones, speakers, a battery and an SoC board are fitted into the arms and front. Display models add a projector in an arm and a waveguide in a lens. Each unit is calibrated and tested, including the capture LED, before signed firmware is loaded.

What is the difference between AI glasses and AR glasses?

Meta's own terms are a good guide: "camera AI glasses" have a camera, mics and speakers but no display; "display AI glasses" add a small in lens display; "augmented reality glasses" have a large holographic display that places content in the world. Google's Android XR docs similarly separate audio glasses from display glasses.

How does a waveguide display work in smart glasses?

A projector in the arm sends an image into the edge of a glass slab in the lens. Light travels inside it by total internal reflection and is released toward your eye by gratings (diffractive) or tiny partial mirrors (geometric). iFixit found a geometric waveguide in Meta Ray-Ban Display and says people across from you cannot see the screen.

Can people tell when smart glasses are recording?

On camera glasses, a white capture LED blinks during capture. Meta says it has no off switch and that its second generation and later glasses disable the camera if the LED is blocked. Regulators have questioned whether a small light is enough notice, so a visible LED is a minimum, not a guarantee that people noticed.

Is it legal to record people with smart glasses?

It depends on where you are and what you record. Photos in public are often lawful, audio of private conversations often needs consent, and private places are restricted. In the EU, the GDPR household exemption is narrow, so posting footage of strangers or recording for work can bring data protection duties.

Where do photos and voice queries from smart glasses go?

Meta says photos and videos stay on the glasses until you import them to your phone. Voice and AI queries go from the glasses through the phone to the vendor's cloud, where the vendor's privacy policy sets retention. Check the companion app for history and deletion controls.

Can smart glasses do facial recognition?

The hardware can capture faces, but recognition needs software and a face database. In the EU, building such databases by untargeted scraping is banned, real time remote biometric identification by law enforcement in public spaces is banned except in narrow cases, and biometric identification data is a special category under the GDPR.

What chip is inside smart glasses?

A wearable class SoC with an image processor, audio DSP, neural processor and radios. Meta says Ray-Ban Meta (2023) uses Qualcomm's Snapdragon AR1 Gen 1, and iFixit found a Snapdragon AR1 with 2 GB of RAM and 32 GB of flash in Meta Ray-Ban Display.

Where Safeguard fits, honestly

Safeguard does not analyse glasses hardware, optics or firmware, and it does not manage devices. Its fit is the software around the glasses that your team builds: companion apps, Android XR projected activities inside a phone app, Lens back ends, and the cloud services that handle images, captions and AI queries. Safeguard scans those codebases and images, builds SBOMs, matches components against vulnerability data, ranks findings with reachability analysis and evaluates policies and gates before release. When a fixed version exists, autonomous remediation can open the upgrade pull request; it ships switched off. The Safeguard CLI's assistant can also edit code and run commands in your repository, asking before any command that changes something.

Firmware, drivers and wireless stacks on any wearable ship open source components, and the companion apps and AI back ends behind smart glasses pull in hundreds more on every build. When one of those components gets a CVE, the fix still has to reach the build that ships to users, which is where the steps below apply.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation categories include dependencies, licenses, security posture and findings, and each one is set separately. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds.

3. Gold Registry: start from components that are already fixed

Gold Registry provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs and a completed license check, with signed build provenance (signed with Safeguard's key and verifiable with cosign, SLSA Build Level 3 as the design target) and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. Ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo is a real Safeguard CLI session asked to fix a lodash CVE in a repository. It reads the finding and the advisory, asks before any command that changes something, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, prints a summary and pushes nothing. The same flow fits the web dashboard or API service behind a glasses companion app, where a vulnerable dependency should be fixed in a reviewed branch rather than by hand.

Click through it at your own pace, or open it full screen.

The second demo is a real Android session: it sends work to a computer running the Safeguard CLI and approves the command on the phone with Allow once, Allow for turn or Deny. Teams building companion apps live on their phones during testing, so approving a scan or a fix from the same device keeps the human decision in the loop without walking back to a desk.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and chooses which Safeguard tools Claude can use. A developer working on an Android XR projected activity could ask Claude which projects carry a vulnerable library version, with Claude limited to the tools that were allowed.

Click through it at your own pace, or open it full screen.

To try it on your own repositories, download Safeguard and follow the CLI documentation.

Quick check

Sources

• Meta, Introducing Ray-Ban Stories: First-Generation Smart Glasses (9 September 2021)
• Meta, Introducing the New Ray-Ban Meta Smart Glasses (27 September 2023)
• Meta, Meta Ray-Ban Display: AI Glasses With an EMG Wristband (17 September 2025)
• Meta, Meta's AI Glasses: Your Questions Answered (7 July 2026)
• Meta, Introducing Ray-Ban Meta Audio Glasses, New Styles and More (23 September 2026)
• iFixit, There's Groundbreaking Waveguide Tech Inside Meta's $800 AR Glasses But Don't Count on Fixing Them (8 October 2025)
• Data Protection Commission (Ireland), Statement concerning Facebook View (glasses) (17 September 2021)
• European Data Protection Board, Guidelines 3/2019 on processing of personal data through video devices, version 2.0 (PDF)
• European Commission, AI Act: regulatory framework for AI
• Google, Android XR: The Gemini era comes to headsets and glasses (12 December 2024)
• Android Developers, Android XR
• Android Developers, Plan to support different types of audio glasses and display glasses
• Android Developers, Request hardware permissions for audio glasses and display glasses
• Android Developers, Use a projected context to access hardware on audio glasses and display glasses
• Snap for Developers, Spectacles permissions and privacy overview
• Snap for Developers, Spectacles Transparent Permission
• Khronos Group, OpenXR overview
• CISA, 2026 Minimum Elements for a Software Bill of Materials

Last reviewed: 25 October 2026.