Safeguard on Android phones and tablets: Play, APK and pairing

Safeguard runs on Android phones and tablets. Install it from Google Play if your device has Play, which is the simple route for most people. Use the direct APK (version 1.0.2) when the phone has no Google Play or your company rolls apps out itself, and check its SHA-256 before you install.

The phone is one part of a bigger setup. Safeguard is one platform on every surface: the CLI in your terminal, the desktop app, the web interface, and the Android and iOS apps. You also keep what you already pay for. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use.

This guide covers both install routes in detail, how to verify the APK, what the phone is good for, and how it fits with the desktop app and the Safeguard CLI.

Two ways onto Android: Google Play or the direct APK

The download page lists two Android options side by side. They install the same product. What differs is where the file comes from, how updates arrive and what you have to change on the device.

When to use Google Play

Choose Play if your phone or tablet has the Play Store and your company lets you install apps from it. You change no security settings, and updates arrive the way every other app's updates do. Google's help page notes that apps are tied to your Google Account rather than a single device, so a tablet signed in to the same account can install it too.

When to use the direct APK

The download page offers the APK for two cases: phones without Google Play, and company-managed rollout where IT distributes approved apps itself.

The trade-off is that you own the update step. The page says it plainly: "Updates come from here, not from Google Play." If you install the APK, come back to the download page for new versions.

Do not run both. Pick one route per device so you always know where the next update comes from.

Install from Google Play, step by step

1. On your phone, open safeguard.sh/download and tap the Google Play link in the Mobile section. Starting from the download page matters: other unrelated apps also use the name "Safeguard", so searching the store by name can land you on the wrong one.
2. Google Play opens on the listing. Check the developer shown on the listing before you tap Install.
3. Tap Install. Google's help page describes the same flow: open the Play Store, find the app, choose Install and follow the steps on screen.
4. Open the app and sign in with your Safeguard account, the same one you use on the web, desktop and CLI.

On a tablet the steps are identical. If you manage several Android devices from one Google Account, Google's help page says you can use the device filter in the Play Store to pick which device to install to.

Install the APK and check its SHA-256

Installing an APK means skipping the store's checks, so the hash comparison is the step that tells you the file you have is the file Safeguard published. The download page asks you to check the file's SHA-256 against the listed value before installing.

Check the hash on a computer

The most reliable way is to download the APK on a computer, check it there, then move that same file to the phone. On macOS:

shasum -a 256 ~/Downloads/Safeguard-1.0.2.apk

On Linux:

sha256sum ~/Downloads/Safeguard-1.0.2.apk

On Windows, the download page uses certutil for its own installer, and the same command works for the APK:

certutil -hashfile "$env:USERPROFILE\Downloads\Safeguard-1.0.2.apk" SHA256

Each command prints a 64-character hex string. Compare it with the SHA-256 printed next to the APK on the download page, every character, not just the first few. If they differ, delete the file and download it again. Do not install a file that does not match.

Allow the install, then switch it back off

Android asks for permission per app: you allow the specific app that opens the APK (your browser or your file manager) to install other apps. The download page says to allow installs from your browser when Android asks. You can also set it ahead of time; the menu varies by maker and Android version. On a Samsung Galaxy, Samsung's support page puts it under Settings, Security and privacy, More security settings, Install unknown apps.

1. Copy the verified APK to the phone, for example over a USB cable into the Download folder.
2. Open it from your file manager. Android prompts you to allow that app to install unknown apps.
3. Turn on "Allow from this source", go back, and tap Install.
4. Once installed, turn that permission off again for the file manager or browser.

Google Play Protect stays relevant here. Google's help page says Play Protect is on by default, checks your device for potentially harmful apps from other sources, and may offer to scan an app it has not seen before. Google recommends keeping it on, and so do we.

Rolling it out to many phones

For a company rollout, IT usually pushes the APK through its device management tool, which handles installs without each person changing settings. For a handful of test devices, Android's own adb tool works. Enable Developer options and USB debugging on the device, connect it, accept the RSA key prompt, then:

adb devices -l
adb install Safeguard-1.0.2.apk

Android's adb documentation shows the -s flag for picking one device when several are connected. Run the hash check before any of this, once, on the file you are about to distribute.

A note for Samsung Galaxy owners

Samsung's Auto Blocker, on by default on Galaxy devices with One UI 6.0 (Android 14) or later, only allows installs from official stores such as Google Play and the Galaxy Store, and it also blocks commands sent over USB. On a Galaxy phone, the Google Play route is the one that works without changing protection settings.

What you can do on the phone

Be clear about what the phone is for. The work that changes code (scanning a folder, editing a file, running a command) happens in the CLI on a computer or in the Cloud CLI. The phone is where you keep up with that work while you are away from your desk.

Check findings. The point of the Android app is to check findings on your phone: see what the latest scans found and keep track of what needs attention before you are back at a keyboard. The download page does not publish a feature-by-feature list for the mobile apps, so this guide does not invent one.

Open the full platform in the browser. The web interface is the full platform in a browser, with nothing to install. On a tablet with a keyboard case it is a comfortable way to work through findings in detail.

Try it without your own data. The cloud sandbox is an isolated tenant against a seeded demo repo, free for seven days with no card. It is a reasonable way to see what Safeguard reports before you connect real projects.

Ask from the chat app you already use. If Claude or ChatGPT is already on your phone, you may not need another place to ask questions. Connect Claude or ChatGPT to the Safeguard MCP server and ask about your vulnerabilities from that chat. The download page says the Claude route is added from Claude's connector directory with a single OAuth sign-in and no API key. This walkthrough shows connecting Claude to the Safeguard MCP server with OAuth and choosing which tools Claude can use.

Click through it at your own pace, or open it full screen.

What the phone does not do: the download page lists the browser extension for Chrome Web Store browsers, Firefox Add-ons and Safari on iPhone, iPad and Mac. It names no Android browser, so treat the extension as a laptop and desktop tool.

Pair your phone with the desktop app and the CLI

There is no pairing code between phone and desktop. "Pairing" here means signing in to the same Safeguard account everywhere, so every surface shows the same platform. Here is how each piece connects.

A day across three screens

Start in the terminal. Sign in to the CLI with /login, scan the repo you are working on and fix what matters. Continue on the desktop app, which puts the whole platform in a native window where you can ask your supply chain anything in plain English. Then check findings on your phone on the way home. Because it is one platform, the findings you check on the phone in the evening come from the same account you scanned with in the morning.

The local runner and its device code

The CLI can also act as a local runner: it picks up scan jobs scheduled from the platform and runs them on your machine. The docs say only SBOMs and findings are uploaded, never source. When you set the runner up, you approve it with a device code, so the machine is tied to your account on purpose rather than by accident. That is the closest thing to "pairing" in the product, and it is about computers, not phones.

Use your computer from Search

Once a computer runs the CLI, you can attach it and a folder, ask for a fix, review the diff and approve the command before it runs. The demo itself notes that computer work from Search is "available, expanding", so treat it as a growing feature.

Click through it at your own pace, or open it full screen.

Do the work properly with the Safeguard CLI

The phone tells you what needs doing. The CLI is where you do it. The Safeguard CLI scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds. It writes code, not only scans it.

Install

On macOS and Linux:

curl -fsSL https://cli.safeguard.sh/install | bash

On Windows, in PowerShell:

irm https://cli.safeguard.sh/install.ps1 | iex

It is a single static binary, so there is no Node, Python or JVM to install first. It runs on macOS, Linux and Windows, on x86_64 or arm64; Windows is x86_64 only. If something looks off afterwards, safeguard doctor checks your environment, sign-in, tools and policy and changes nothing.

First session

Move into a project and start the CLI with no arguments:

cd ~/projects/mobile-backend
safeguard

That opens the interactive terminal. Type /login to sign in through the browser, then /scan . to scan the current folder. You can also just ask, for example "how many critical vulns do we have". @ attaches a file from the folder you started in, and /resume picks up your last session in that folder.

Writing and fixing code

The assistant has tools for your local files and for your Safeguard data, and it picks whichever the question needs. Ask "fix the lodash CVE in this repo" and it can edit the code and run commands to check the change, with your approval. It also works as a general terminal assistant for tasks on your machine: find and read files ("what's the latest file in ~/Downloads"), edit code, run commands. Because the same assistant sees your findings, you can go from the alert you read on your phone to a fix in one session. If another coding agent made the change, scan it before you merge; our guide on checking coding agent changes walks through that.

Use your Claude, ChatGPT or Codex plan

Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. /model shows or switches the AI model; for connecting a model, see the CLI docs and the /model picker. If you would rather stay in a chat app, connect Claude or ChatGPT to the Safeguard MCP server instead.

Approvals

Tools that change things (writing a file, editing code, running a command) ask before they act. /permissions sets the mode. Ask prompts before every action. Auto approves known actions and asks about anything new, and it is the default. Yolo approves everything. The current mode is shown in the bar under the input.

Scans from the shell and CI with safeguard exec

Outside the interactive terminal, the same binary scans one target per run and writes JSON results under ./output, such as vuln.json and license.json:

safeguard scan --dir .
safeguard scan --image nginx:latest
safeguard validate sbom.json
safeguard exec "summarise the critical findings in this repository"

safeguard validate checks CycloneDX, SPDX and VEX documents. safeguard exec runs one non-interactive assistant turn for CI; its default permission mode is strict, so anything your policy file has not pre-approved is denied. Policies and gates are evaluated in the platform, not by the CLI. When the local runner runs platform scan jobs, your source code never leaves the machine; only SBOMs and findings are uploaded.

Common mistakes

Searching the store by name. Other apps are called Safeguard. Start from the link on the download page.

Installing an APK you did not verify. A file from a chat message, a shared drive or a mirror site is not the file on the download page until its SHA-256 matches. Check the full string.

Leaving "Install unknown apps" switched on. Allow it for the one install, then turn it off for that browser or file manager.

Mixing Play and APK on one device. Pick one. With the APK, updates come from the download page, not from Google Play.

Turning off Play Protect to make an install work. If Play Protect warns you, stop and re-check the file and its source instead.

Expecting the phone to scan code. Scans and code changes happen in the CLI on a computer, in the Cloud CLI, or through the local runner. The phone is for keeping up.

Looking for a browser extension on Android. The download page names no Android browser for the extension.

Choosing Yolo on a machine you share. Auto, the default, still asks about anything new. Ask is stricter. Pick the mode that matches how much you want to review.

FAQ

Is Safeguard on Google Play?

Yes. The download page lists Android from Google Play for phones and tablets. Open the Play link from the download page rather than searching by name.

When should I use the APK instead of Google Play?

When the phone has no Google Play, or when your company rolls out apps itself. The download page offers APK 1.0.2 for those cases. Otherwise, use Play.

How do I check the APK's SHA-256?

Download it on a computer and run shasum -a 256 on macOS, sha256sum on Linux or certutil -hashfile ... SHA256 on Windows. Compare the full output with the value on the download page. Only install a match.

Does the APK update itself?

The download page says updates for the APK come from the download page, not from Google Play. Check back there for new versions.

Does it work on Android tablets?

Yes. The download page lists Google Play for phones and tablets. The install steps are the same.

Can I keep my Claude, ChatGPT or Codex plan if I switch to Safeguard?

Yes. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use.

How do I pair my phone with the desktop app and the CLI?

Sign in to the same Safeguard account in each. There is no separate pairing code for the phone. The CLI signs in with /login in the browser, and a local runner is approved with a device code.

Does my source code go to the phone or the platform?

When the local runner runs platform scan jobs, only SBOMs and findings are uploaded; source stays on the machine. The phone shows results, not your source.

Try it yourself

This walkthrough is the "install and start the CLI" step: set up the runner on your own machine, pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.

Click through it at your own pace, or open it full screen.

Ready to set it up? Get the Android app and the CLI from the download page, run safeguard, type /login, and scan your first folder. The full reference is in the CLI docs. Comparing tools first? Our roundup of Claude Code alternatives covers the wider field.

Quick check

Sources

• Safeguard downloads
• Safeguard CLI overview
• Safeguard CLI interactive terminal
• Safeguard CLI usage guide
• Google Play Help: download apps on your Android device
• Google Play Help: Google Play Protect
• Android Developers: Android Debug Bridge (adb)
• Samsung Knox: Samsung Auto Blocker
• Samsung support: allow installs from unknown sources

Last reviewed: 21 October 2026.