Can the Safeguard JetBrains plugin review a vendor SBOM?

Not directly. The Safeguard JetBrains plugin scans the manifests in your own project and shows vulnerabilities in a tool window. Its published docs list SBOM export as not documented for JetBrains, and they describe no vendor SBOM import. To review a vendor SBOM from inside the IDE, use the Safeguard CLI in the IDE's built-in terminal.

What does the plugin do?

According to Safeguard's IDE docs, the plugin works in IntelliJ IDEA, PyCharm, WebStorm, GoLand, Rider and other JetBrains IDEs. It scans the same manifest families as the VS Code extension: npm, Yarn and pnpm files, pip, Poetry and Pipenv files, Maven and Gradle files, Go modules, Cargo and Bundler.

The documented entry points are:

• Tools, then Safeguard, then Login, which uses an OAuth device flow in your browser.
• Right-click a manifest in the project tree, then Safeguard, then Scan File for Vulnerabilities.
• Tools, then Safeguard, then Scan Project for the whole project.
• The Safeguard tool window, a tree where you expand a package to see its CVEs and open CVSS and CWE details.
• Alt+Enter on a flagged dependency, then Fix with Safeguard AI, with a choice between safe, balanced and aggressive strategies and a diff to review.

Public package scanning works without signing in, per the docs, while backend features need a login.

What is not documented for JetBrains?

The docs include a feature comparison. For JetBrains they mark Package Firewall inline checks, the interactive chat assistant and SBOM export as not documented, where the VS Code and Cursor extension has them. They also say there is no published command list for the plugin.

"Not documented" does not mean the feature is absent forever, but we write only what the docs state. If you need a vendor SBOM review today, plan on a different route.

How do you review a vendor SBOM from a JetBrains IDE?

Use the IDE's terminal with the Safeguard CLI. The CLI installs from its own page and runs on macOS, Windows and Linux. Its scan command accepts an existing SPDX or CycloneDX document, and its validate command checks SBOM files against the specifications.

1. Put the vendor file in a folder outside your source tree, so it never lands in a commit.
2. Open the IDE terminal in that folder.
3. Validate the file:

safeguard validate vendor-sbom.json

4. Scan it:

safeguard scan --sbom vendor-sbom.json --output out/

5. Read the results from the output folder, or in the terminal summary.

The IDE adds little to this job beyond a convenient terminal. Its value comes after, when the vendor's components overlap with your own manifests. If a vendor library with a known issue is also in your project, the plugin will show it inline on your side.

What should you check in the vendor file?

Check the NTIA minimum elements: supplier, component name, version, other identifiers, dependency relationships, SBOM author and timestamp. Look at the age of the file, whether it covers bundled and operating system packages, and whether licenses are marked. Ask for a VEX statement when a finding does not apply to their product.

What are the limits?

A vendor SBOM reflects what their tool detected. A scan of it reports known issues in listed components only. The docs list the plugin's requirements as IDE version 2023.3 or later and JDK 17 or later, so check those first if the Tools menu entry is missing.

What to do

1. Install the plugin from Settings, then Plugins, search Safeguard, then restart the IDE.
2. Log in from Tools, then Safeguard, then Login.
3. Scan your own project first to see the baseline.
4. Install the Safeguard CLI for vendor file review.
5. Validate then scan the vendor SBOM in the IDE terminal.
6. Compare vendor components against your own findings.
7. Send the vendor the gaps you found.

This demo shows the in-editor view that Safeguard gives you while you code.

Open the full demo

Quick check

Sources

• Safeguard docs: IDE Support
• Safeguard CLI
• NTIA: Minimum Elements for an SBOM

Last reviewed: 18 October 2026.