The Safeguard extension for VS Code shows dependency risk while you edit, such as CVE details and exploit signals on a declared package. According to Safeguard's docs, SBOM generation itself runs from the CLI command safeguard scan or from the web app, so the practical flow is to read risk in the editor and generate the SBOM in a terminal.
What does the VS Code extension do?
Safeguard publishes IDE extensions for VS Code, Cursor (through Open VSX) and the JetBrains IDEs. The product page describes real-time feedback as you write code: it flags typosquatted package names and risky patterns such as unsafe deserialization, and it runs a small local model for fast verdicts.
Where a dependency is declared, hovering shows a CVE summary plus EPSS and KEV status. EPSS estimates how likely a CVE is to be exploited, and KEV flags vulnerabilities known to be exploited. Together they help you rank what to fix first. The page also lists suggested patched versions and an offline mode that works against a local mirror.
That is the editor job: catch a bad dependency before it reaches a pull request.
Can the extension generate the SBOM?
We could not confirm that from the official docs. The docs page on generating SBOMs describes two surfaces, the web platform and the CLI. IDE generation is not described there. Some blog posts on our own site mention an in-editor generate command, but because the docs do not back that up, this post leaves it out. If you want an SBOM from your editor window, open the integrated terminal and use the CLI.
How do I generate the SBOM from the terminal?
The CLI docs list four input sources for the scan command:
safeguard scan --dir .
safeguard scan --repo URL
safeguard scan --image REF
safeguard scan --sbom FILE
Install it with the one line for your system from cli.safeguard.sh. On macOS and Linux that is a curl pipe to bash, and on Windows a PowerShell command. The installer verifies the release checksum, and you can download the script first and read it. Then run the scan from your project root:
safeguard scan --dir .
Results are written to an output folder, with sbom.json among the artifacts next to findings, vulnerability and license files. Per the docs, when you are signed in the scan uploads the SBOM and findings to the platform, while source code stays on your machine.
Typical generation time on the platform side, per the docs, is under a minute for fewer than 100 dependencies and 5 to 15 minutes above 500.
Which route fits which job?
- Catching a risky package as you type: the VS Code extension.
- Producing an SBOM file for a repo on your laptop: the CLI in the integrated terminal.
- Keeping SBOMs fresh across many repos: the web app, with scans on push, on a schedule or on release.
The web route starts at Integrations in the sidebar, where you connect a repository and pick a branch, project name and version. Projects are scanned daily, and you can add triggers.
What should I check about the SBOM output?
Two things, and neither depends on which tool you use.
First, the SBOM is only as good as your lockfile. If a project has no lockfile, dependency versions are guesses. Commit lockfiles.
Second, ask which format you need. The docs we fetched say the CLI accepts SPDX and CycloneDX documents as input and validates against both, but they do not state the output format of generated SBOMs. Check the file you get against what your recipient expects, whether that is a customer, an auditor or a procurement team.
What to do
- Install the Safeguard extension for VS Code from the marketplace, and check the publisher name before you click install, since lookalike extensions exist for any popular tool.
- Sign in and open a project with a manifest and lockfile.
- Hover over a flagged dependency and read the CVE, EPSS and KEV details before deciding to bump it.
- Open the integrated terminal and run the CLI scan with the directory option.
- Open sbom.json and confirm the components list matches your lockfile.
- For repos you do not touch daily, connect them in the web app so SBOMs refresh on a schedule.
Quick check
Does the VS Code extension export an SBOM?
The official docs describe SBOM generation through the web app and the CLI. Use the CLI in the integrated terminal for a file.
Does my source code leave my machine during a CLI scan?
Per the docs, scans uploaded while signed in send the SBOM and findings. Source code stays on your machine.
Sources
Last reviewed: 18 October 2026.
