In the Safeguard desktop app, which is in beta, you scan a local folder from the Scan tab, run the CLI from the Terminal tab to build an SBOM, and read the results in the web app beside it. The docs describe no dedicated SBOM button in the panel, so this post shows the path that exists.
What is the desktop app?
It is an Electron app for macOS, Windows and Linux that wraps the Safeguard web app rather than replacing it. One window has two views. On the left is app.safeguard.sh. On the right is a local panel that can reach things a browser tab cannot, such as folders you grant, a shell and MCP servers.
Press Cmd+Shift+S on macOS, or Ctrl+Shift+S elsewhere, to toggle the panel. The panel has tabs for Scan, Terminal, MCP, Tasks, Files and Settings. Remember that the app is early access, so expect changes.
How do you install it safely?
Downloads are listed on safeguard.sh/download. The docs say macOS builds are signed and notarized, while Windows builds are not yet code signed, so SmartScreen shows a warning. They publish a SHA256SUMS file beside each installer. Check it:
shasum -a 256 -c SHA256SUMS
On Windows, compare the output of certutil -hashfile against the manifest by eye.
How do you give it a project?
Open the Files tab and grant a folder through your operating system's file picker. The app can read only folders you have granted, and it rejects attempts to step outside them with ../ paths.
How do you scan it?
Open the Scan tab, add the project folder and choose quick or full. Quick looks shallower in the folder tree for manifests. Full searches deeper into subdirectories. Results are grouped as critical, high, medium, low and unknown. You can also switch on auto-scan for the project. According to the docs, scanning runs locally without pushing the project anywhere first.
How do you get an SBOM file?
Use the Terminal tab. It runs only allowlisted programs, and safeguard-cli, safeguard and sg are on the list. The working directory has to be inside a folder you granted. The CLI documentation says safeguard scan builds an SBOM for a target, matches it against vulnerability databases, and writes JSON files under an output folder, with ./output as the default.
safeguard scan --dir .
Results include vuln.json, license.json and collection.json, among others, in a folder for each scan. The docs do not name the SBOM file here, so look in the output folder rather than assuming a filename. If you already hold an SBOM in SPDX or CycloneDX, scan it directly, or validate it first:
safeguard scan --sbom sbom.json
safeguard validate sbom.json
To see a project in the platform with your others, the CLI documentation says to scan from the interactive terminal with /scan and a path while signed in. The runner uploads the SBOM and findings, never your source.
How do you read it in the web app?
The left pane is the normal web app. Open the project and use the Project Overview tabs from the Explore SBOM documentation:
- Info: project details and charts such as Findings by Severity and Findings by Gate.
- Attestation: attestation and risk scores, with provenance checks.
- Dependencies: the full tree, or a sortable table with license and vulnerability counts.
- Provenance: source repository, build system and commit details.
- Vulnerabilities: counts by severity, affected components and fix recommendations.
You can also generate an SBOM from a connected source. The Generate SBOM documentation lists repository hosts, container registries and uploaded manifests under the Integrations page.
Open the full walkthrough at /demos/sca-dependency-inventory.
What are the limits?
This is a beta, so check the current documentation for any step that looks different. The Scan tab can fall back to manifest based analysis if the bundled CLI is not yet available for your platform. And an SBOM is an inventory: it says what is inside, not whether a flaw can be reached.
What to do
- Download the app from safeguard.sh/download and verify the checksum.
- Sign in on the left pane.
- Grant the project folder in the Files tab.
- Run a quick scan in the Scan tab, then a full one if needed.
- In Terminal, run the directory scan command shown above and open the output folder.
- Sign in and use /scan from the interactive terminal to upload results.
- Read the dependencies and vulnerabilities tabs in the web app.
Quick check
Does the desktop app upload my source code?
The documentation says scanning runs locally, and that the runner uploads the SBOM and findings, never your source. Confirm this against the current docs for your version.
Is the desktop app generally available?
No. It is early access, in beta. Use the web app or CLI for anything you cannot risk changing.
Sources
- Safeguard docs: Desktop Application
- Safeguard docs: CLI usage
- Safeguard docs: Generate SBOM
- Safeguard docs: Explore SBOM
Last reviewed: 18 October 2026.
