The Safeguard CLI has two update commands, and they are not interchangeable. The update command refreshes the vulnerability databases the scanners use. The self-update command replaces the safeguard binary itself. Neither installs missing scanners, which happens during first-run setup. Run the first often and the second deliberately.
What each command does
safeguard update
safeguard self-update
The help text for the first one is blunt: it updates the grype and trivy vulnerability databases, and it does not update the safeguard binary. It adds that machines run it from cron, and that if automatic download fails, for example from running out of memory, an import option loads a database you downloaded by hand.
The second command updates the binary. The usage docs say a check option only reports whether a release exists, without installing it.
Why the databases matter more often
New vulnerabilities are published every day. A scan with a stale database cannot match what it has not heard of, so the output looks cleaner than reality. That is a quiet failure, since nothing errors.
For developer laptops, refreshing now and then is enough. For scheduled scans and CI runners, refresh before each scan, or on a short schedule if the runner is long lived.
# example cron entry, daily at 02:30
30 2 * * * safeguard update
Record the date of the last successful refresh somewhere you can see it, since a failed cron job is easy to miss.
Why the binary should change slowly
A new binary can change flags, output files and detection behaviour. In CI you want that to happen when you decide. The installation docs describe pinning a version for this reason, and two environment variables turn off automatic checks:
export SAFEGUARD_NO_UPDATE_CHECK=1
export SAFEGUARD_DISABLE_SELF_UPDATE=1
The first skips the background release check. The second disables binary updates entirely.
Scanners are a third thing
A new install has no scanner tools. Running safeguard once downloads the toolchain. The database update command only refreshes databases for scanners that already exist, so a missing syft is a setup problem, not an update problem.
If your runners are locked down, you can place the tools yourself and point the tools directory variable at them.
Restricted networks
Where a machine cannot reach the internet, download the database elsewhere and import it. The usage docs mention this import path. The air gapped deployment page describes signed snapshot bundles for the platform side, and says the install runbook for that setup is provided to authorized tenants. For specifics, ask your Safeguard contact rather than guessing.
A simple policy
- Databases: refresh daily, or before every scan in CI.
- Binary: pin, then upgrade on a schedule you choose, with a test run.
- Scanners: installed once through first-run setup, then managed with the binary.
Quick check
Does the update command upgrade the CLI?
No. It refreshes vulnerability databases only. Use self-update to replace the binary, and the check option to see whether a release exists first.
What if a database download fails on a small runner?
Download the database on a bigger machine and use the import option to load it.
Safeguard also offers a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
