Some security work should not happen on your own machine. Opening an unknown repository, running a suspicious package, or letting an agent browse the web are all things you would rather do somewhere disposable. Safeguard offers cloud sandboxes for this, along with a cloud browser, a cloud CLI and a cloud credential vault.
What it is
The Safeguard download page lists a group of cloud options next to the web interface: a cloud computer, a cloud sandbox, a cloud browser, a cloud CLI and a cloud credential vault. Together they give you a workspace that lives in the cloud instead of on your device. Work can start there, keep running when you close your laptop, and be picked up again later from any surface.
The pieces fit one idea. The sandbox is where code and tools run. The browser is where web pages load, away from your own sessions and cookies. The CLI is the same Safeguard command line you would use locally, running in that workspace. The vault holds the credentials the work needs, so they are not pasted into a terminal on your machine.
Why it matters
- Isolation. A repository you do not trust can be scanned and built in a place that cannot reach your files or your logged in accounts.
- Continuity. A long scan or an agent task does not depend on your battery or your network.
- Clean credentials. Keeping secrets in a vault instead of shell history or environment files reduces what can leak.
- A consistent setup. Everyone on the team works in the same environment, which makes results easier to compare.
Examples
A security engineer receives a pull request from an unfamiliar contributor. Instead of cloning it locally, they open it in a sandbox, run the scan there and read the findings. A researcher wants to look at a suspicious web page, so the cloud browser loads it and keeps it away from their own browser profile. A team lead asks the agent to work through a fix campaign overnight, and the work continues in the cloud while everyone is offline.
How it fits with local work
Safeguard also runs locally, through the CLI, the local runner and the desktop app, for cases where source code must stay on your machine. The runner uploads only results. Choose cloud when isolation and continuity matter most, and local when data residency does. A tenant admin can switch off any client type, so the options you see depend on your organization.
How to start
- Check the download page for the cloud options enabled for you.
- Try a throwaway repository first.
- Store credentials in the vault, not in files.
- Decide with your administrator which projects may run in the cloud at all.
Quick check
When would you pick a cloud sandbox over the local runner?
When you want isolation from your own machine or a task that keeps running while you are away. Use the local runner when source code must stay on your machine.
