Use the IDE for hints while coding, the CLI for local and one-off checks, CI for repeatable runs, and the pull request for the enforced gate. They overlap in tooling but differ in purpose: some give feedback, one gives control.
Definitions
- IDE scan: an extension that checks code and dependencies inside the editor.
- CLI scan: a command you run in a terminal, locally or inside a script.
- CI scan: a job in your continuous integration pipeline, triggered automatically.
- Pull request scan: a CI scan tied to a pull request or merge request, whose result can block a merge.
The last two are often the same job viewed from different angles. What makes it a pull request scan is the trigger and the required status.
What each stage is for
| Stage | Job | Who triggers it | Can it be skipped? |
|---|---|---|---|
| IDE | Fast hints | The developer, passively | Yes |
| CLI | Local checks, investigation, custom pipelines | A person or a script | Yes, if manual |
| CI | Repeatable automated runs | A pipeline event | Not if required |
| Pull request | Enforced gate before merge | A pull request event | Not if required |
Choosing by team size
| Team size | Start with | Add next |
|---|---|---|
| 1 to 5 | Pull request scan | IDE, weekly rescan |
| 5 to 50 | Pull request scan plus shared policy | IDE, scheduled rescan, ownership routing |
| 50 and up | Default-on pipeline templates, tiered gates | Inventory, release gates, central exceptions |
The common thread: the enforced stage first, the convenient stages after.
Common questions
Do I need all four? No. The enforced pull request stage is the one that matters most. The others add speed and coverage.
Which one produces audit evidence? CI and pull request runs, because they are recorded and repeatable. IDE and manual CLI runs leave weaker records.
Can the same tool do all four? Often yes, which helps keep one policy. Check that the tool reads the same configuration in each place.
Steps to decide
- Write down what you must enforce. This is your pull request or CI scope.
- Write down what you want fast. This is your IDE and pre-commit scope.
- Write down what you need to investigate. This is your CLI use.
- Check that all three read the same policy.
- Review after a quarter against developer feedback and escape rates.
Related reading
See which scan stage a five person team should set up first and when to run a scan from the CLI instead of CI.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at what a dependency inventory contains, since every stage in this guide reads from that same picture.
Where Safeguard fits
Safeguard is available as a desktop app, a CLI, extensions for VS Code, JetBrains, and browsers, plus pull request gates, all driven by shared policies. You can start with the free scan at https://gold.safeguard.sh/scan.
Quick check
Which stage should I set up first?
The pull request stage, made a required check, because it is the one every change must pass.
Is the CLI the same as CI?
No. The CLI is a tool you can run anywhere. CI is where you choose to run it automatically and consistently.
Last reviewed: 19 October 2026.
