Yes, Safeguard works across Samsung Galaxy devices. Galaxy phones and tablets install the Android app from Google Play; there is no Galaxy Store listing. Galaxy Book laptops run Windows, so they use the Windows desktop app, the Safeguard CLI and the browser extension in Chrome or Firefox. Samsung Internet is not listed for the extension.
That gives you one platform on every Galaxy screen you own: start in the terminal on your Galaxy Book, continue in the desktop app, check findings on your Galaxy phone. You also keep what you already pay for. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use.
Everything below comes from the Safeguard download page and from Samsung's and Microsoft's own documentation. Where the download page does not list something, this guide says so rather than guessing.
What to install on each Galaxy device
Samsung makes phones, tablets and Windows laptops under the Galaxy name, and each one takes a different Safeguard install. Here is the map.
| Galaxy device | What to install | Where it comes from | Worth knowing |
|---|---|---|---|
| Galaxy phone | Safeguard Android app | Google Play | No Galaxy Store listing |
| Galaxy Tab | Safeguard Android app | Google Play | Same app as phones |
| Galaxy Book with Intel chip | Desktop app 3.2.2 and CLI 1.4.0 | safeguard.sh/download | Windows x64 installer; CLI ships for Windows x86_64 |
| Galaxy Book with Snapdragon chip | Desktop app 3.2.2 | safeguard.sh/download | The Windows installer covers ARM; the CLI is listed for Windows x86_64 only |
| Browser on a Galaxy Book | Extension 1.0.4 | Chrome Web Store or Firefox Add-ons | Samsung Internet is not listed |
And what is not on the list. The download page does not list the Samsung Galaxy Store, a Samsung Internet extension or the Microsoft Store. If you find a "Safeguard" in one of those places, it is not this product.
Galaxy phones and tablets: install from Google Play
On a Galaxy phone or tablet, Google Play is the route. Samsung treats Google Play as an official store alongside its own Galaxy Store, and Play is where Safeguard's Android app is listed.
- On the phone, open safeguard.sh/download and tap the Google Play link in the Mobile section. Start from the download page rather than searching the store, since other unrelated apps share the "Safeguard" name.
- Check the developer on the Play listing, then tap Install.
- Open the app and sign in with your Safeguard account, the same one you use on your Galaxy Book.
A Galaxy Tab follows the same steps. Google's help page notes that apps are tied to your Google Account rather than a single device, so if your phone and tablet share an account you can install on both.
Why Play is the easy route on a Galaxy
Samsung's Auto Blocker matters here. According to Samsung's Knox documentation, Auto Blocker is available on Galaxy devices running One UI 6.0 (Android 14) or later and is enabled by default. With it on, "only apps from official stores such as the Google Play Store and Galaxy Store can be installed." It also blocks commands sent over USB cables from devices such as PCs.
Google Play is one of those official stores, so installing Safeguard from Play needs no change to your protection settings. That is the main reason to prefer Play on a Galaxy, even though Safeguard also publishes a direct APK.
If you need the direct APK on a Galaxy
The download page offers a direct APK (1.0.2, 69 MB) for phones without Google Play and for company-managed rollout. Galaxy phones normally ship with Play, so most people will not need it. If your IT team distributes the APK, expect two extra steps on recent Galaxy devices.
Auto Blocker. With Auto Blocker on, apps from outside Google Play and the Galaxy Store will not install. Samsung's support page puts the switch under Settings, Security and privacy, Auto Blocker, and says such apps won't install unless it is turned off. Samsung recommends keeping it on, so switch it back on right after the install.
Install unknown apps. Samsung's support page gives the path as Settings, Security and privacy, More security settings, Install unknown apps. Pick the app you will install from, such as Chrome or your file manager, and turn on its switch. Samsung's guidance is to enable this only when needed and disable it once you are done.
Before any of that, check the file. The download page asks you to compare the APK's SHA-256 with the listed value before installing. Download it on a computer and run:
certutil -hashfile "$env:USERPROFILE\Downloads\Safeguard-1.0.2.apk" SHA256
On a Mac use shasum -a 256, on Linux sha256sum. Compare the full 64-character result with the value on the download page. If any character differs, delete the file and download it again.
One more APK detail: the download page says updates for the APK "come from here, not from Google Play." With the APK, you check the download page for new versions yourself.
Galaxy Book laptops: the Windows desktop app
Galaxy Book laptops run Windows, so Safeguard treats them as Windows PCs. The desktop app (3.2.2) puts the whole platform in a native window, where you can ask your supply chain anything in plain English.
First, check which chip you have
Galaxy Books come with different processors. Samsung's India support page lists Galaxy Book3 and Galaxy Book2 models with Intel Core i5, i7 and i9 chips, and the Galaxy Book Go with a Qualcomm chip. Samsung's newsroom describes the Galaxy Book4 Edge as powered by the Snapdragon X Elite. Intel models are x64; Snapdragon models are Arm.
To check yours, open Settings, System, About and look at the processor name under Device specifications. Or ask PowerShell:
$env:PROCESSOR_ARCHITECTURE
AMD64 means an x64 machine. ARM64 means Arm.
Install the desktop app
The download page lists one Windows installer for Windows 10 and 11 that covers both x64 and ARM, plus architecture-specific installers if you want them. So both kinds of Galaxy Book use the same file.
- Download
Safeguard-3.2.2.exe(205 MB) from the download page. - Check its hash in PowerShell and compare it with the SHA-256 on the page:
certutil -hashfile "$env:USERPROFILE\Downloads\Safeguard-3.2.2.exe" SHA256
- Run the installer. It installs per user and needs no administrator rights, which helps on a company Galaxy Book where you are not a local admin.
- The installer is not yet code-signed, so Windows SmartScreen shows "Windows protected your PC." The download page says this is expected and not a sign the file is corrupt. Once the hash matches, choose More info, then Run anyway.
- Open Safeguard and sign in.
Verify the hash before you click past SmartScreen, never after. That order is the whole point of the check.
Galaxy Book laptops: the Safeguard CLI
The CLI is where the hands-on work happens: scanning, writing and fixing code, running commands with your approval. On Windows it installs from PowerShell:
irm https://cli.safeguard.sh/install.ps1 | iex
The installer detects your OS and verifies the checksum before adding anything to your PATH. CLI 1.4.0 ships binaries for macOS Apple Silicon and Intel, Linux x86_64 and arm64, and Windows x86_64.
On an Intel Galaxy Book
This is the listed configuration. Install, open a new PowerShell window, and run safeguard.
On a Snapdragon Galaxy Book
The Windows CLI is listed for x86_64 only, and the download page does not list a Windows Arm build. Microsoft documents that Windows 11 on Arm emulates x64 apps, with the Prism emulator included from Windows 11 24H2, and that emulation is transparent and needs no extra components. Safeguard does not list that combination, though, so treat it as untested and check it on your own machine before you depend on it. Two listed options work regardless of chip: the desktop app, whose Windows installer covers ARM, and the Cloud CLI, which runs the CLI on Safeguard's infrastructure so scans need no local runner.
Galaxy Book laptops: the browser extension
The Safeguard browser extension (1.0.4) puts Griffin search in a side panel. On a Galaxy Book you install it in one of the listed browsers:
- Chrome Web Store, which covers Chrome, Brave, Arc, Vivaldi, Opera and Edge. The download page notes Edge gets its own listing later.
- Firefox Add-ons for Firefox.
Samsung Internet is not on that list, on the laptop or the phone. If Samsung Internet is your everyday browser, keep a listed browser for Safeguard work.
With the extension, Search can also work in a browser tab you hand it, step by step. This walkthrough shows how: you set Ask, Auto or Yolo; it stops and asks before a risky step such as submitting a form (Allow once or Don't allow); every step is kept on record. Browser control must be enabled for the workspace.
Click through it at your own pace, or open it full screen.
One account across your Galaxy devices
There is no pairing code between a Galaxy phone and a Galaxy Book. You sign in to the same Safeguard account on each, and every surface shows the same platform.
A normal day might look like this. On the Galaxy Book, open PowerShell in your project, start safeguard, sign in with /login, scan the folder and fix what matters. Switch to the desktop app to look across products and ask questions in plain English. Later, check findings on your Galaxy phone. The heavy work stays on the laptop; the phone keeps you current.
If you already live in ChatGPT or Claude on your Galaxy devices, connect them too. The download page says ChatGPT installs Safeguard from its directory, or you can import the schema at https://mcp.safeguard.sh/openapi.json. This walkthrough shows connecting ChatGPT to the Safeguard MCP server with OAuth and choosing which tools ChatGPT can use.
Click through it at your own pace, or open it full screen.
For Claude, the download page says to add Safeguard from Claude's connector directory and sign in once with OAuth, with no API key. Any other MCP client can use the endpoint https://mcp.safeguard.sh/mcp.
Do the work properly with the Safeguard CLI
The Safeguard CLI scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds. It writes code, not only scans it. On a Galaxy Book, this is the tool that turns a finding into a fix.
Install
On Windows, as above: irm https://cli.safeguard.sh/install.ps1 | iex. On macOS and Linux:
curl -fsSL https://cli.safeguard.sh/install | bash
It is a single static binary, with no Node, Python or JVM needed. It runs on macOS, Linux and Windows, on x86_64 or arm64; Windows is x86_64 only. safeguard doctor checks your environment, sign-in, tools and policy if anything looks wrong, and changes nothing.
First session
cd $env:USERPROFILE\projects\orders-api
safeguard
Running safeguard with no arguments opens the interactive terminal. Type /login to sign in through the browser, then /scan . to scan the current folder. Or ask in plain language: "how many critical vulns do we have". @ attaches a file from the folder you started in, and /resume picks up the last session in that folder.
Writing and fixing code
The assistant has tools for your local files and for your Safeguard data, and picks whichever the question needs. Ask "fix the lodash CVE in this repo" and it can edit code and run commands, with your approval. It also handles ordinary tasks on your Galaxy Book: find and read files ("what's the latest file in ~/Downloads"), edit code, run commands. If a different coding agent wrote the change, scan it before you merge; our guide to checking coding agent changes shows how.
Use your Claude, ChatGPT or Codex plan
Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. /model shows or switches the AI model. For connecting a model, see the CLI docs and the /model picker. More on how that works in our post on the Safeguard CLI as an assistant on your machine.
Approvals
Tools that change things (writing a file, editing code, running a command) ask before they act. /permissions sets the mode: Ask prompts before every action; Auto approves known actions and asks about anything new, and is the default; Yolo approves everything. The current mode sits in the bar under the input.
Scans from the shell and CI with safeguard exec
safeguard scan --dir .
safeguard scan --repo https://github.com/org/repo
safeguard validate sbom.json
safeguard exec "summarise the critical findings in this repository"
safeguard scan takes one target per run (--dir, --repo, --image or --sbom), builds an SBOM, matches it against vulnerability databases and writes JSON files under ./output, such as vuln.json and license.json. safeguard validate checks CycloneDX, SPDX and VEX documents. safeguard exec runs one non-interactive assistant turn for CI; its default permission mode is strict, so anything your policy file has not pre-approved is denied. Policies and gates are evaluated in the platform, not by the CLI. When the local runner runs platform scan jobs, your source code never leaves the machine; only SBOMs and findings are uploaded.
Common mistakes
Looking in the Galaxy Store. Safeguard is not listed there. Use Google Play.
Turning off Auto Blocker to install from Play. You do not need to. Play is one of the stores Auto Blocker allows.
Leaving Auto Blocker off after an APK install. If IT asked you to install the APK, turn Auto Blocker and Install unknown apps back to where they were once it is done.
Expecting Safeguard in Samsung Internet. The extension is listed for Chrome Web Store browsers and Firefox, not Samsung Internet.
Clicking past SmartScreen before checking the hash. Compare the installer's SHA-256 with the download page first, then choose More info and Run anyway.
Assuming every Galaxy Book is x64. Some are Snapdragon. The desktop installer covers both; the CLI is listed for Windows x86_64.
Searching the Microsoft Store. It is not listed there. Download from safeguard.sh.
Choosing Yolo on a shared laptop. Auto, the default, still asks about anything new; Ask asks about everything.
FAQ
Is Safeguard in the Samsung Galaxy Store?
No. The download page does not list the Galaxy Store. Galaxy phones and tablets install Safeguard from Google Play.
Does Auto Blocker stop me from installing Safeguard?
Not from Google Play. Samsung says Auto Blocker allows installs from official stores such as Google Play and the Galaxy Store. It does block the direct APK until you turn it off.
Does Safeguard work on a Galaxy Tab?
Yes. The download page lists the Android app on Google Play for phones and tablets, and a Galaxy Tab installs it the same way.
Which Safeguard apps run on a Galaxy Book?
Galaxy Books run Windows, so the Windows desktop app (3.2.2), the Safeguard CLI (Windows x86_64) and the browser extension in Chrome or Firefox. On a Snapdragon Galaxy Book, the desktop installer covers ARM; the CLI is not listed for Windows on Arm.
Is there a Samsung Internet extension?
No. The download page lists the extension for the Chrome Web Store (Chrome, Brave, Arc, Vivaldi, Opera, Edge), Firefox Add-ons, and Safari on iPhone and iPad (Safari on Mac is in Apple review). Samsung Internet is not listed.
Can I keep my Claude, ChatGPT or Codex plan if I switch to Safeguard?
Yes. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use.
Why does Windows warn me about the installer?
The Windows installer is not yet code-signed, so SmartScreen shows a warning. The download page says this is expected. Verify the SHA-256 first, then More info and Run anyway.
Does my source code leave my Galaxy Book?
When the local runner runs platform scan jobs, only SBOMs and findings are uploaded; your source code stays on the machine.
Try it yourself
This walkthrough is the "install and start the CLI" step: set up the runner on your own machine, pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.
Click through it at your own pace, or open it full screen.
Ready? Get the Android app for your Galaxy phone and the desktop app and CLI for your Galaxy Book from the download page, then run safeguard and type /login. The full reference is in the CLI docs. Weighing up coding tools first? See our comparison of AI coding agents.
Quick check
Where do Galaxy phones and tablets get Safeguard?
From Google Play. Safeguard is not listed in the Galaxy Store.
On a Galaxy Book, which browsers can run the Safeguard extension?
Browsers served by the Chrome Web Store (Chrome, Brave, Arc, Vivaldi, Opera, Edge) and Firefox through Firefox Add-ons. Samsung Internet is not listed.
Sources
- Safeguard downloads
- Safeguard CLI overview
- Safeguard CLI interactive terminal
- Safeguard CLI usage guide
- Samsung Knox: Samsung Auto Blocker
- Samsung support: Auto Blocker on Galaxy devices
- Samsung support: allow installs from unknown sources
- Samsung support: Galaxy Book models with Windows 11
- Samsung Newsroom: Galaxy Book4 Edge release
- Microsoft Learn: how emulation works on Arm
- Google Play Help: download apps on your Android device
Last reviewed: 21 October 2026.
