The Safeguard JetBrains plugin does not document scheduled scans. It scans manifests as you work, on save or project open, and on demand. Scheduled and continuous scanning happen in the Safeguard platform, and you can run on-demand scans from the CLI. Use the plugin for fast feedback and the platform for the clock.
The original idea for this post was a scheduler walkthrough in the IDE. The docs do not support that, so this is what the plugin does and how to get the same coverage another way.
What does the JetBrains plugin do?
Per the plugin docs (version 5.0.1 at the time of writing), it needs IDE 2023.3 or later and JDK 17 or newer. It covers npm, Yarn and pnpm, pip, Poetry and Pipenv, Maven and Gradle, Go modules, Cargo and Bundler.
Inside the IDE you get:
- Inline warnings on vulnerable dependencies in manifests.
- A Safeguard tool window with a tree: expand a package to see its CVEs, double click one for CVSS and CWE detail.
- Severity colors on affected lines.
- A quick fix: put the cursor on a flagged dependency, press Alt+Enter and choose Fix with Safeguard AI. You pick a strategy (Safe, Balanced or Aggressive) and review the diff before it applies.
- A bulk action in the tool window, Fix All Vulnerabilities.
How do you install and sign in?
Open Settings, then Plugins, search for Safeguard, install and restart. You can also install from a downloaded ZIP with the gear menu. Sign in under Tools, Safeguard, Login. It uses an OAuth device flow, so you approve in the browser.
How do you scan manually?
Right click a manifest and choose Safeguard, Scan File for Vulnerabilities. Or use Tools, Safeguard, Scan Project. The docs mark scan on save and on project open as supported for JetBrains but do not explain how to configure them, so check the plugin settings in your IDE rather than assuming defaults.
Where does scheduling actually happen?
In the platform. The continuous scanning docs say source repositories rescan on every push plus an hourly pull for missed webhooks, and that running container images rescan on push and every 4 hours. Rescans also run when a vulnerability feed update affects a component you use. Scan frequency settings sit under Policies, then Scan Policies, and a custom interval can be set with scan.interval on an asset label, for example 24h for sandbox environments.
For a one off, the docs show an on-demand command in the CLI: safeguard scan --asset with an asset id.
So the practical setup is two layers. The IDE catches problems while you edit. The platform catches the ones that appear later, when a new advisory lands against a package you already shipped.
What are the gaps?
The plugin docs say these are not documented for JetBrains: Package Firewall inline checks, an interactive AI chat assistant and SBOM export. If you need those, use the web app or CLI. The docs also do not publish a full JetBrains settings reference.
What to do
- Install the plugin and sign in with the device flow.
- Run Scan Project once and read the tool window tree.
- Use the quick fix on one low risk dependency and review the diff before applying.
- Confirm in the plugin settings whether scan on save fits your workflow.
- Turn on the platform scan policy for the repository so rescans happen without anyone opening an IDE.
- Set a tighter interval only for assets that justify the noise.
Quick check
Is there a scheduler inside the JetBrains plugin?
Not in the documentation. Scheduling is described for the platform's scan policies, not for the plugin.
Which fix strategy should I pick first?
Safe is the sensible start. Review the diff for any strategy before applying it.
Sources
Last reviewed: 18 October 2026.
