The Safeguard Chrome extension does not generate SBOMs. It opens Safeguard's Griffin search in a side panel next to whatever tab you are on, so you can ask questions while reading an SBOM in another tab. SBOM generation happens in the CLI and CI, and the Portal manages and exports them.
What does the extension actually do?
Safeguard's documentation describes the browser extension as a thin wrapper. It adds a toolbar icon labeled Open Safeguard, opens a side panel in Chrome that loads the search page of the Safeguard web app, and handles login inside that page. The extension does not store credentials or call Safeguard APIs itself. On Chrome it asks for only the sidePanel permission, and it needs Chrome 114 or later.
To set it up, install it from the Chrome Web Store, pin the icon and click it. Sign in, run a search, then close and reopen the panel to confirm you stay signed in. The documentation lists a known issue: a session may be lost after a browser restart because of how the web app's cookie interacts with side panels, and it says the fix is server-side. If that happens, sign in again.
There is a second extension, Gold Open Source, described as a launcher for the Gold registry at gold.safeguard.sh, for package lookups.
Where do SBOMs come from?
Generation takes place elsewhere. The Safeguard CLI, an npm package named @safeguard-sh/cli that needs Node 18 or later, generates SBOMs and runs scans and gates across many package managers, and its CI output can be SARIF or JUnit. The Portal section of the documentation describes centralized SBOM management: a repository organized by product, version and team, with version history, import of existing SBOMs, and secure sharing with time-limited links. It lists exports in SPDX (JSON, XML, RDF) and CycloneDX (JSON, XML), plus spreadsheet and document formats.
How do you read an SBOM in ten minutes?
Open the SBOM in one tab and Safeguard search in the side panel. Work through these passes.
Minutes 1 to 2: what is it about? Find the product, version and generation date. An SBOM generated last year describes last year's software.
Minutes 3 to 4: how many components? Count direct and transitive components. Most of the list will be components nobody chose on purpose. Note the ecosystems involved.
Minutes 5 to 6: spot the unusual. Look for components with no version, no license, an unfamiliar supplier, or names that look like near-copies of popular packages. These are the rows to investigate.
Minutes 7 to 8: ask the panel. Ask about a component by name and version, such as what is known about its vulnerabilities and fixes. Treat answers as leads and confirm important ones against the advisory source.
Minutes 9 to 10: decide what is reachable. A listed vulnerable component is not necessarily exploitable in your product. Reachability analysis shows whether your code can reach the flawed function. Record the conclusion and a review date.
Open the SCA dependency inventory demo
What are the limits?
An SBOM lists what was found at build time. It may miss components vendored by hand, or runtime downloads. The side panel is a search and chat window, so it will not replace your pipeline. Admins can switch off any client type for the tenant, including the browser extension, so if the icon opens a blocked message, ask your administrator.
What to do
- Install the Chrome extension from the Chrome Web Store and pin it.
- Sign in, run a test search and confirm the session persists.
- Generate SBOMs in CI with the CLI, not from the browser.
- Export or share through the Portal in SPDX or CycloneDX if a customer asks.
- Read each SBOM with the checklist: age, count, oddities, questions, reachability.
- Confirm any security-critical answer from the panel against the original advisory.
- Store the review notes with a date.
Quick check
Can the Safeguard Chrome extension create an SBOM?
No. It opens the Safeguard search page in a side panel. SBOMs are generated with the CLI and CI and managed in the Portal.
Which SBOM formats can the Portal export?
According to the documentation, SPDX in JSON, XML and RDF, and CycloneDX in JSON and XML, among other formats.
Sources
Last reviewed: 18 October 2026.
