Reviewing SBOMs from VS Code: what works and what to use for vendor files

The Safeguard VS Code extension generates a CycloneDX SBOM from your own project's lockfile and shows it in a read-only preview. For an SBOM you received from a vendor, the documented route is the Safeguard CLI, which can validate the file and scan it. This post covers both, so you pick the right tool.

What does the VS Code extension do?

Safeguard's getting-started guide for the extension lists these requirements: VS Code 1.85 or later, a Safeguard account (the free tier works), and a locally checked-out project with a supported manifest such as package.json, go.mod or Cargo.toml. For accuracy it needs a lockfile, and the guide says it will not guess from the manifest.

The guide's install advice is to search for "Safeguard" in the Extensions view and install the one from the publisher "Safeguard Technologies", checking the publisher first because lookalike names exist. Two Safeguard pages we read give slightly different extension identifiers, so we recommend installing from the Marketplace listing and confirming the publisher there rather than copying an identifier from a blog post. After a reload, a shield icon appears in the activity bar. Select Sign in, confirm the one-time code in your browser at the Safeguard device page, or use Sign in with SSO if your organization requires it.

How do you generate and read an SBOM?

1. Open the Command Palette and run Safeguard: Generate SBOM.
2. The extension builds a CycloneDX SBOM by resolving your lockfile.
3. It writes the file to .safeguard/sbom.cdx.json and opens it in a read-only preview pane.
4. To change the format, set safeguard.sbom.format in your .vscode/settings.json.

Two related commands from the guide are useful in reviews. Safeguard: Compare SBOM diffs SBOMs between branches, which shows what a change adds or removes. Safeguard: Export Report creates a Markdown report of findings. The guide does not describe a dedicated SBOM export command, so use the generated file as your artifact.

What about a vendor's SBOM?

The extension, as documented, works from your own project's lockfile. It does not describe importing someone else's SBOM. For a vendor file, the CLI site lists two commands built for the job:

safeguard validate FILE
safeguard scan --sbom FILE

The first checks that the document is valid against SPDX and CycloneDX. The second matches the components against the advisory database. Run validate first, because a malformed file produces misleading results.

What should a review look for?

• Completeness: does the SBOM list transitive dependencies, or only top-level ones?
• Version precision: are versions exact, with package identifiers, or vague?
• Freshness: does the date match the release you are buying or deploying?
• Known vulnerabilities and which of them matter for the way the product runs.
• Licenses that conflict with your policy.

Ask the vendor about anything missing. An incomplete SBOM is a finding in itself.

What to do

1. Install the extension from the Marketplace after confirming the publisher.
2. Make sure your project has a lockfile, then run Safeguard: Generate SBOM.
3. Use Compare SBOM when reviewing a branch that changes dependencies.
4. For vendor files, run safeguard validate FILE and then safeguard scan --sbom FILE.
5. Write down gaps and open questions for the vendor.
6. Re-run when the vendor sends a new release.

Quick check

Sources

• Safeguard blog: Getting started with the Safeguard IDE extension for VS Code, fetched 18 October 2026.
• Safeguard CLI, fetched 18 October 2026.

Last reviewed: 18 October 2026.