The Safeguard JetBrains plugin does not document SBOM export today. It scans your manifests, shows a vulnerability tree in a tool window and offers AI assisted fixes. SBOM export is documented in the VS Code and Cursor extension, and the CLI builds an SBOM internally when it scans. Use whichever fits your workflow.
What does the JetBrains plugin do?
According to the Safeguard IDE support docs, the plugin is a separate codebase from the VS Code and Cursor extension, with its own version number. It requires a 2023.3 or later IDE with JDK 17 or newer, and covers IntelliJ IDEA, PyCharm, WebStorm, PhpStorm, Rider, GoLand, RubyMine, CLion, DataGrip and Android Studio.
Install it from Settings, then Plugins, by searching for Safeguard, installing and restarting. Sign in from Tools, then Safeguard, then Login. This uses a device flow: you approve a code in the browser at app.safeguard.sh/activate. Public package scanning works without login.
It reads these manifests: package.json with its lockfiles, requirements.txt, pyproject.toml and Pipfile, pom.xml and Gradle files, go.mod and go.sum, Cargo files and Gemfiles.
How do you scan and read the results?
Right click a manifest and choose Safeguard, then Scan File for Vulnerabilities, or use Tools, then Safeguard, then Scan Project. Results appear in a Safeguard tool window as a vulnerability tree. Double click a CVE to see its CVSS and CWE details. Vulnerable lines are highlighted in the editor by severity.
Reading the tree is a useful habit. Start with the highest severity items on direct dependencies, since you can usually change those yourself. Then look at transitive items, which often resolve by bumping the parent.
How do you fix a finding?
Put the cursor on a flagged line and press Alt+Enter, or Option+Return on a Mac, then choose Fix with Safeguard AI and review the diff before accepting. To fix a package or the whole project, right click its node in the tool window and choose Fix All Vulnerabilities.
The docs describe three strategies: Safe, which applies minor updates only, Balanced, which is the default and applies minor and patch updates, and Aggressive, which moves to the latest version. Always run your tests after a bump.
So where do you get an SBOM?
Three documented routes:
- VS Code or Cursor. The extension lists an SBOM panel and commands named Generate SBOM, Export SBOM and Compare SBOM with Previous, with CycloneDX and SPDX export.
- The CLI. The scan command accepts a directory, repository, container image or an existing SBOM file. The CLI page says scan builds the SBOM internally and that there is no standalone sbom command, and validate checks SBOM files against the SPDX and CycloneDX specifications.
- A combined workflow. Many JetBrains users keep the plugin for day to day fixing and run the CLI in CI for the artifact.
The IDE docs mark SBOM export and interactive chat as "not documented" for JetBrains, so check the docs again before you plan around it.
Try the flow on its own page: IDE gate demo.
What to do
- Install the plugin and sign in with the device flow.
- Scan the project and sort the tree by severity.
- Fix direct dependencies first with the Balanced strategy, then run tests.
- Run the CLI scan in CI to produce the SBOM your customers or auditors want.
- Validate that file with the CLI validate command.
Quick check
Does the plugin work without an account?
Public package scanning works without login. Backend features such as notifications need you to sign in.
Which IDEs does it support?
The JetBrains family listed in the docs, from IntelliJ IDEA and PyCharm to Rider, GoLand and Android Studio.
Sources
Last reviewed: 18 October 2026.
