Safeguard cloud computer and cloud browser: a working guide

Safeguard's cloud computer is the full platform hosted by Safeguard and opened in your browser: search, scans, SBOMs, compliance and reporting. The cloud browser is a remote browser session running Safeguard, streamed to your tab. Both start from one sign-in at app.safeguard.sh, need nothing installed, and share the same data as the CLI, desktop and phone apps.

You do not give up the assistant you already pay for. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. And if you would rather stay in the chat you already use, connect Claude or ChatGPT to the Safeguard MCP server and ask Safeguard from there.

This guide is for days when you cannot install anything: a borrowed laptop, a locked down corporate machine, a hotel desk. It walks through each hosted option, then connects the cloud to your own computer and phone.

What you will have at the end

By the end of this guide you will have:

• A clear picture of the five hosted options on the Safeguard download page and which one fits which job.
• A signed-in cloud computer session with search, filters and keyboard shortcuts you can use from the first minute.
• A plan for the cloud browser on machines where you can open a tab and little else.
• The Cloud CLI for scans that need no local runner, plus the credential vault set up for the keys those cloud runners use.
• A way to hand work from the cloud to your own computer and approve it from the desktop app or your phone.
• A short list of signals that tell you when to add the local Safeguard CLI.

The hosted options at a glance

The download page groups these under one heading: "Hosted by Safeguard, nothing to install." Every description below is from that page, checked on 21 October 2026.

The same page lists local counterparts for each: the browser extension, the desktop app (the "Computer" entry), an isolated local sandbox to try scans and fixes against throwaway state, and the CLI. Its own summary is the one to keep in mind: "Run it on your own machine, or let us host it. Every surface talks to the same platform and the same findings."

That is what makes the cloud options practical. A finding you triage in the cloud computer is the same finding your colleague sees in the desktop app and you see later on your phone.

Open the cloud computer and find your way around

The cloud computer's Open Safeguard button on the download page points to app.safeguard.sh, the same address as the web interface. The download page describes the web interface as the full platform in a browser and "what the desktop app puts in its own window", so the skills you build here carry over to the desktop app unchanged.

Step by step: your first session

1. Open app.safeguard.sh in a current browser. The web app docs list Chrome or Chromium 120 and later (recommended), Edge 120+, Firefox 125+ and Safari 17.4+.
2. Sign in. The default is email plus a passkey. TOTP or a WebAuthn hardware key is available where you need higher assurance, and Enterprise tenants can use SSO.
3. If your organization is on the EU region, use eu.app.safeguard.sh instead. The region is set at signup, so use the address your account was created on.
4. Press / to focus the global search bar. It queries every product through the asset graph.
5. Type a package name or a CVE ID as plain text, or use filters. The docs give this example:

severity:critical AND reachable:true AND project:payments-service

6. Press ? to see every keyboard shortcut. The ones worth learning first are g h for home, g v for vulnerabilities, g p for policies and g w for workflows.
7. If you will come back to this machine, use your browser's "Install app" prompt. The web app is a Progressive Web App, so it gets its own window without a separate installer.

Habits that make the cloud computer faster

Start broad and narrow down. Stacking filters with AND narrows the results, and the docs warn that an overly narrow query can return nothing. If a search comes back empty, drop the last filter before you conclude there is nothing to find.

Use reachability early. reachable:true is one of the most useful filters on a long list, because it keeps findings where your code actually uses the vulnerable part of a dependency. Safeguard's reachability analysis is generally available.

Leave the tab open. The web app pushes real-time updates for new vulnerabilities, remediation progress and workflow step state.

Mind the session clock. By default a session ends after 8 hours idle or 24 hours in total, and Enterprise tenants can set shorter limits. On a shared or borrowed machine, sign out when you finish rather than relying on the timeout.

What to do in the cloud computer on day one

A good first hour looks like this:

1. Search for your highest priority project and open its findings.
2. Filter to severity:critical and then add reachable:true. Note how the list changes.
3. Open one finding and follow it to the component and the dependency path that pulls it in.
4. Look at the policies area (g p) to see what your team already enforces. Policies and gates are evaluated in the platform, so this is where their results live.
5. Export or schedule the report your team needs. The download page says Safeguard generates SBOMs in SPDX and CycloneDX and exports reports as PDF, CSV or JSON.

The cloud browser for locked down machines

The cloud browser is a different tool for a different problem. Instead of running the web app in your own browser, it runs a browser session on Safeguard's side and streams it to your tab. The download page describes it as "a remote browser session running Safeguard, streamed to your tab, nothing to install locally."

When it is the right choice

• Your own browser is managed and you cannot install extensions or change settings.
• You are on a shared or borrowed machine and want your Safeguard work kept out of that browser's history and storage as far as possible.
• You want a clean session that is separate from the dozens of tabs and extensions in your everyday browser.

If none of those apply, the cloud computer in a normal tab is simpler. Both reach the same platform and the same findings.

Step by step

1. Sign in at app.safeguard.sh. The cloud browser's Open Safeguard button on the download page points there.
2. Start the cloud browser session from your account.
3. Work as you would in the cloud computer: search, open findings, review policies.
4. When you finish, sign out of Safeguard and close the tab.

The exact screens inside your account can change between releases. If you cannot see the option, ask your Safeguard administrator whether it is enabled for your workspace.

Your own browser, with Safeguard in it

There is a third way to use Safeguard in a browser: the Safeguard extension in the browser you already use. Version 1.0.4 is on the Chrome Web Store (for Chrome, Brave, Arc, Vivaldi, Opera and Edge) and on Firefox Add-ons. On iPhone and iPad it comes inside the Safeguard app and is turned on in Settings, Apps, Safari, Extensions. Safari on Mac is in Apple review, so it is not available there yet.

The extension puts search in a side panel next to whatever tab you are on. With browser control enabled for your workspace, Search can also work in a browser tab you hand it. This demo shows how: Search works in the tab step by step, you set Ask, Auto or Yolo, and it stops and asks before a risky step such as submitting a form, with Allow once or Don't allow. Every step is kept on record.

Click through it at your own pace, or open it full screen.

The difference from the cloud browser is where the browser lives. The extension runs in your browser on your machine. The cloud browser runs on Safeguard's side and you only see the stream.

Scan with nothing installed: the Cloud CLI

The Cloud CLI is the Safeguard CLI running on Safeguard's infrastructure, so a scan needs no local runner. You get the CLI's way of working without putting a binary on the machine in front of you.

When to use it

• You need to scan a repository and the machine you are on does not allow installs.
• You want to try the CLI's way of working before you install it locally.
• Nobody on the team has a runner set up yet and you need results today.

The trade-off to understand first

Where the work happens matters. With the local CLI and its built-in runner, your source code never leaves your machine; only SBOMs and findings are uploaded. With the Cloud CLI, the CLI runs on Safeguard's side. Choose the Cloud CLI when installing is not an option and that is acceptable for the code in question. Choose the local CLI when keeping source on your own device is the rule.

Set up the credential vault first

Hosted runners need credentials to reach the things they scan. The download page's cloud credential vault is where you "sign in and manage the API keys, tokens and secrets the cloud runners authenticate with", and its Manage API keys button opens the developer settings in your account.

A few rules keep the vault tidy:

1. Create one key per purpose. A key for a CI pipeline and a key for a hosted scan job should be separate, so you can revoke one without breaking the other.
2. Give each key only the scopes it needs. The CI docs, for example, ask for a key with scans:trigger and scans:read for a pipeline that starts a scan and waits for the result.
3. Name keys after where they are used, such as "payments-api GitHub Actions", so the list still makes sense in six months.
4. Revoke keys you no longer use.

Connect the cloud to your own computer and phone

The cloud options are a starting point, not a separate island. Safeguard sessions follow you across devices, and the cloud is one of the things your other devices connect to.

A Safeguard CLI session on your own computer is live: it shows in the web app, the desktop app and the phone app, and other devices can send work to it. From the desktop or phone app you can send work to a computer running the CLI: pick the computer and folder, then approve each command and file edit there.

This recorded demo shows it in the desktop app. The CLI session appears in the conversation list. "2 connected" shows the computer, the browser and Safeguard cloud. You ask for work on your computer, it asks which computer and folder, you pick the folder, then Approve or Deny each command and file edit. It ends with the upgrade done and tests passing.

Click through it at your own pace, or open it full screen.

Keep your computer reachable from the cloud and your phone

If you want to send work to your own computer while you are away from it, the CLI can register its runner as a per-user login service:

safeguard login
safeguard runner install --workspace ~/code/payments-api
safeguard runner status

The help text says this lets your phone or browser send turns to the machine from any network for as long as it is on. Nothing listens on a port; the runner only opens outbound HTTPS. On Linux it uses a systemd user unit, on macOS a LaunchAgent and on Windows a logon scheduled task. Undo it with safeguard runner uninstall.

Approve from your phone

The Android and iOS apps show the same conversations. On Android, "Work on my computer" picks a computer running the CLI and a folder, and each command waits for Allow once, Allow for turn or Deny on the phone. That is useful when you started something in the cloud computer at your desk and want to finish it on the way home. Our guide to Safeguard on Android phones and tablets covers the phone side in detail.

Move links and notes between devices

Two small CLI commands help when you hop between the cloud and your own machines:

safeguard devices
safeguard send --to my-phone --link https://app.safeguard.sh
safeguard inbox

safeguard devices lists your signed-in devices that can send and receive. safeguard send sends a link or text (up to 8,000 characters) to one of them by name, name prefix or id. safeguard inbox shows what your other devices sent to this CLI.

Try the platform first with the cloud sandbox

If you have not connected your own code yet, start with the cloud sandbox. It is a hosted, isolated tenant against a seeded demo repo, free for seven days, and needs no card. Because the repo is seeded, you can practise every step in this guide (search, filters, reachability, policies, reports) before any of your own code is involved.

It shows how Safeguard behaves, not what it will find in your projects, so keep it for demo data only.

Do the work properly with the Safeguard CLI

The hosted options cover a lot. When you want an assistant that edits code in your own repository, the local Safeguard CLI is the next step. It scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds. It can write code, not only scan it. For the full tour, see Use the Safeguard CLI as an AI assistant on your own machine.

Install

It is a single static binary with no Node, Python or JVM needed. It runs on macOS, Linux and Windows, on x86_64 or arm64, with Windows on x86_64 only. The installer verifies a checksum before it puts anything on your PATH.

# macOS and Linux
curl -fsSL https://cli.safeguard.sh/install | bash

# Windows PowerShell
irm https://cli.safeguard.sh/install.ps1 | iex

On a Mac, the macOS install guide walks through each step.

First session

safeguard
/login
/scan .

Running safeguard with no arguments opens the interactive terminal. /login signs you in through the browser, and /scan . scans the current folder. Then ask in plain language, for example "how many critical vulns do we have" or "fix the lodash CVE in this repo". The assistant has tools for your local files and for your Safeguard data and picks whichever the question needs, so it also works as a general terminal assistant: find and read files, edit code and run commands, with your approval.

/model shows or switches the AI model. @ attaches a file from the folder you started in. /resume picks up the last session in that folder.

Use your Claude, ChatGPT or Codex plan

Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. See /model and the CLI docs for connecting a model.

Approvals

Tools that change things ask before they act. /permissions sets the mode:

• Ask: reads run; edits and commands ask first.
• Accept edits: edits in this folder and read-only commands run; other commands ask.
• Plan: read and plan only.
• Auto: read-only commands and what the policy allows run; anything else asks. This is the default.
• Strict: pre-approved actions only, for CI.

There is also a --yolo flag that approves everything. Keep it for throwaway sandboxes.

CI with safeguard exec

safeguard exec "summarise the critical findings in this repository"

safeguard exec runs one non-interactive assistant turn, which is the shape a pipeline needs. Policies and gates are still evaluated in the platform, so you see the result in the cloud computer like everything else.

Troubleshooting

The search returns nothing

Remove filters one at a time. AND narrows results, and the docs note that an unconnected repository does not appear in search or the asset graph at all, and neither does an image without an SBOM. If the project is missing entirely, it has not been connected yet.

I signed in but I am in the wrong region

The region is fixed at signup. If your organization's account is on the EU region, use eu.app.safeguard.sh. Changing region needs a data migration engagement, not a setting.

The cloud browser or Cloud CLI is not shown in my account

Ask your Safeguard administrator whether it is enabled for your workspace. Meanwhile, the cloud computer at app.safeguard.sh gives you search, findings, SBOMs and reports.

My phone cannot send work to my computer

Check that the computer is on, signed in and running the CLI. safeguard runner status shows the runner state, and safeguard doctor checks the installation, sign-in and tools and changes nothing.

Common mistakes

Using the cloud browser when a normal tab would do

On your own laptop with a normal browser, the cloud computer in a tab is simpler. Keep the cloud browser for restricted or shared machines.

Assuming the Cloud CLI keeps source local

It runs on Safeguard's infrastructure. The guarantee that source never leaves the machine applies to the local CLI and its runner, which upload only SBOMs and findings.

One API key for everything

Separate keys per pipeline or job, scoped to what each needs, make revoking one painless.

Turning on Yolo on a real repository

On your own code, start with Ask or Auto. The --yolo flag is for throwaway sandboxes.

FAQ

What is the difference between the cloud computer and the web interface?

Both are the full platform in a browser, and both open from app.safeguard.sh. The download page lists the cloud computer under hosted options and describes it as the full platform hosted by Safeguard, with search, scans, SBOMs, compliance and reporting and nothing to install.

What is the cloud browser?

A remote browser session running Safeguard on Safeguard's infrastructure and streamed to your tab. It suits locked down or shared machines.

Does the Cloud CLI need a local runner?

No. It is the CLI running on Safeguard's infrastructure, so a scan needs no local runner. The trade-off is that the work happens on Safeguard's side rather than on your machine.

Can I keep using my Claude, ChatGPT or Codex plan?

Yes. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server; see connect Claude to the Safeguard MCP server.

Can I approve work on my own computer from the cloud or my phone?

From the desktop or phone app you can send work to a computer running the CLI, pick the folder, and approve each command and file edit. The computer needs to be on and running the CLI.

Where do I manage keys for hosted scans and CI?

In the cloud credential vault, which the download page links as Manage API keys. It holds the API keys, tokens and secrets the cloud runners authenticate with.

When should I install the local CLI?

When you want source kept on your machine, want the assistant to edit files in your repository with your approval, or want checks in CI with safeguard exec.

Try it yourself

When you are ready to add your own machine, this walkthrough shows the setup: set up the runner on your own machine, pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.

Click through it at your own pace, or open it full screen.

Start a sandbox or open the hosted options at safeguard.sh/download. For the desktop side of this guide, read the Safeguard desktop app guide, and when you install locally, keep the Safeguard CLI docs open.

Quick check

Sources

• Safeguard download page
• Safeguard CLI documentation
• Safeguard CLI interactive terminal
• Safeguard web application docs
• Safeguard Local Runner docs
• Safeguard desktop app docs
• Safeguard browser extension docs
• Safeguard CI/CD integration docs
• Safeguard reachability analysis docs

Last reviewed: 21 October 2026.