Run scans where the data already lives and where results will be trusted. Laptop scans give fast feedback, CI scans give consistency, and hosted services give shared history. Most teams need a local check for speed and a pipeline check for the record.
What actually moves
Before choosing, ask what leaves the machine. A manifest lists package names and versions. Source code is far more sensitive. Some tools only send the inventory, some send code, and some do the matching entirely on your device.
Safeguard's free scan page is an example of the browser based end of this spectrum: it says files are parsed in your browser and never sent to a server, and it needs no login. That statement covers that page only. Always read each tool's data handling statement instead of assuming.
Four criteria
Speed. A scan on your laptop returns while you are still in the file. A pipeline scan returns minutes later. Fast feedback changes behaviour, because people fix what they see immediately.
Consistency. Laptops differ. Different tool versions, caches and operating systems can produce different results. A pipeline scan on a pinned image gives the answer you can compare run to run.
Coverage. Local scans see unpushed work. Pipeline scans see only what was committed. Hosted services see what was reported to them.
Authority. When a release is blocked, which result counts? Decide in advance. The usual answer is the pipeline, because nobody can edit it by accident.
A layered setup
- Developer machine: fast checks on save or before a commit, advisory only.
- Pull request: the same checks with a gate that can block.
- Scheduled job: rescan the main branch and recent releases, because new advisories arrive after a build.
- Shared service: store history so trends and audit trails exist.
Each layer catches what the one before missed. None of them replaces the others.
Cost of time
Count the time spent waiting and the time spent investigating false alarms. A slow scan that nobody reads is worse than a fast partial one. Tune for signal: reduce noise with reachability and known exploitation data before you add more scanning.
Privacy and regulated data
If policy forbids sending code off a device, choose tools whose data handling you have confirmed in writing, and keep an inventory of where scan results are stored. Results can reveal your internal package names and project structure, so treat them as internal data.
Related reading: Safeguard Desktop, web app or CLI.
Where Safeguard fits
Safeguard offers a native desktop app, a CLI for pipelines, and a hosted workspace, so each layer above has a surface. Start with the free scan at gold.safeguard.sh/scan.
Quick check
Where does the free scan process my file?
The page says files are parsed in your browser and never sent to a server.
Which result should block a release?
Decide in advance. Most teams treat the pipeline result as authoritative.
Sources
Last reviewed: 19 October 2026.
