You can scan a project with the Safeguard CLI in two commands, then read which findings are marked reachable from your own code. The CLI site shows a finding annotated as "Reachable from utils/render.js." For a plain-language explanation of why, use chat in the web app, since the CLI has no documented explain command.
How do you install and sign in?
The CLI site gives one-line installers. On macOS and Linux:
curl -fsSL https://cli.safeguard.sh/install | bash
On Windows PowerShell:
irm https://cli.safeguard.sh/install.ps1 | iex
The npm package is @safeguard-sh/cli and needs Node 18 or later. Then sign in with safeguard login, which uses the OAuth device flow, and run safeguard init to write the local scanner configuration.
How do you scan?
The scan command takes one input at a time. From the CLI site:
safeguard scan --dir .
The same command accepts --repo URL for a repository, --image REF for a container image, or --sbom FILE for an existing SBOM. It builds the software bill of materials and matches it against the advisory database. If you want to refresh the local vulnerability data first, safeguard update does that.
The CLI site says your code stays on your machine and only SBOMs and findings are uploaded. Check that statement against your own policy before you scan a sensitive repository.
What does "reachable" mean in the output?
A vulnerable dependency is a risk only if your code can get to the vulnerable part. Safeguard's documentation describes reachability as a prioritization signal based on call path analysis (is the vulnerable code actually called), runtime context and configuration impact. The CLI site's example output marks a finding with the file it is reachable from, which gives you a starting point: open that file and follow the call into the library.
Read a reachable finding in this order:
- Note the package, the version and the advisory.
- Open the file the finding names.
- Find where your code calls into the package, and what input reaches that call.
- Check whether a fixed version exists and whether the upgrade is a patch or a major version change.
What if you want an explanation in words?
The CLI documents scan, resolve, validate, fix, patch-image, report and runner commands, but we did not find an explain command in the documentation. The web app at app.safeguard.sh is chat-first, so you can ask there why a finding is reachable and what to do about it, and check the answer against the call path you read yourself. The model's explanation is a guide, and the code is the evidence.
How do you fix a reachable finding?
The CLI site lists safeguard fix --severity high to update vulnerable packages and write a patched SBOM, with --dry-run to preview and --create-pr to open a pull request. Preview first, read the diff, run your tests, then open the pull request.
What to do
- Install the CLI and run
safeguard loginandsafeguard init. - Run
safeguard scan --dir .in a project with a lockfile. - Sort the results with reachable findings first.
- Trace each reachable finding to the calling code in the named file.
- Preview upgrades with
safeguard fix --severity high --dry-run. - Run tests, then use
--create-prso a reviewer sees the change. - Ask in the web app chat when you need the reasoning in words.
- Re-scan after the merge and confirm the finding is gone.
Quick check
Does the Safeguard CLI have an explain command?
Not in the documentation we found on the CLI site. It lists scan, resolve, validate, fix, patch-image, report, runner and update. Use the web app chat for explanations.
Can I scan a container image with the CLI?
Yes. The scan command takes --image REF as one of its inputs, alongside --dir, --repo and --sbom.
Sources
- Safeguard CLI, fetched 18 October 2026.
- Safeguard docs: Vulnerabilities, fetched 18 October 2026.
Last reviewed: 18 October 2026.
