How do you review a vendor SBOM in the Safeguard desktop app (beta)?

In the Safeguard desktop app, which is in early access beta, review a vendor SBOM through the Terminal tab: grant the folder that holds the file, run the CLI validate command on it, then run a scan against the SBOM. The docs describe no dedicated SBOM import screen, so this CLI route is the documented path.

Why not just click Import?

We checked the desktop documentation before writing this. The panel has tabs for Scan, Terminal, MCP, Tasks, Files and Settings. The Scan tab is described as running vulnerability scans against local projects you add. It does not mention loading a third-party SBOM file. If a later release adds that, the docs will say so, and this post will need an update.

What the docs do confirm is that the Terminal tab can run an allowlist of binaries that includes the Safeguard CLI, and that the CLI can validate SBOM documents and scan an existing SPDX or CycloneDX file. Combined, they cover the job.

What does the desktop app add?

The desktop app wraps the web app and adds a local panel on the right, toggled with Cmd+Shift+S on macOS or Ctrl+Shift+S on Windows and Linux. The local panel can reach your filesystem, but only for folders you grant. Commands run only if the working directory is inside a granted folder, and only binaries on the allowlist run. That makes it a reasonably contained place to open a file you did not create.

How do you do it?

Step 1. Save the file. Put the vendor's SBOM in a folder you are happy to grant, for example a new folder named vendor-review. Keep the original untouched.

Step 2. Grant the folder. Open the panel and use the Files tab to pick the folder through your operating system's file picker.

Step 3. Validate the format. In the Terminal tab, run the CLI validate command on the file. It checks SPDX, CycloneDX and VEX documents against their specifications. A file that fails here is a finding about the vendor before you read a single component.

safeguard validate vendor-sbom.json

Step 4. Scan the SBOM. Run the scan command with the sbom option pointing at the same file. The CLI matches the components against vulnerability data and reports by severity. Add an output folder if you want the machine-readable files the CLI writes.

safeguard scan --sbom vendor-sbom.json --output out/

You may need to sign in for the CLI first, using the login command, which uses a device flow in your browser.

What should you look for besides vulnerabilities?

A scan answers one question. A vendor SBOM review has more. Use the NTIA minimum elements as a baseline and check each component entry for supplier name, component name, version, other unique identifiers, dependency relationships, the SBOM author and a timestamp. Missing versions and missing relationships make any scan result weaker.

Then check these:

• Staleness. A timestamp from a year ago describes an old build.
• Coverage. Does the file list operating system packages and bundled libraries, or only top-level ones?
• Licenses. Unknown or conflicting licenses are a legal question.
• Secrets. Safeguard's secrets scanning docs list vendor SBOMs as a surface where build-provenance fields can leak credentials. Run the secrets detect command on the folder as well.
• Component age. End-of-life components without a patch path matter more than a medium CVE.

Ask the vendor for a VEX statement when a finding looks unreachable. CISA describes VEX as an attestation that says whether a product is affected by a known vulnerability, and it is the right way for a vendor to answer "does this apply to you?"

What are the limits?

The SBOM reflects what the vendor's tool saw. It will not list what the vendor did not detect. A clean result means no known issue in the listed components, not that the product is safe. The desktop app is in beta, so features and menus may change between releases.

What to do

1. Install the desktop app and sign in, knowing it is in early access beta.
2. Create a review folder and grant it in the Files tab.
3. Run the validate command on the vendor file and record any errors.
4. Run the scan command with the sbom option and save the output.
5. Check minimum elements, age and coverage by hand.
6. Run the secrets detect command on the folder.
7. Send the vendor a list of findings and ask for VEX statements.

Here is what a dependency inventory looks like, which is the view you want from a vendor file.

Open the full demo

Quick check

Sources

• Safeguard docs: Desktop Application
• Safeguard CLI
• Safeguard docs: Secrets scanning
• NTIA: Minimum Elements for an SBOM
• CISA: Software Bill of Materials

Last reviewed: 18 October 2026.