Security questions rarely start in a console. They start in a channel: someone sees a CVE headline and asks whether we are affected. Safeguard Tag is built for that moment. You mention Safeguard in the chat tool your team already uses, ask the question in plain words, and the answer comes back in the same thread.
What it is
Safeguard Tag is the @-mention way of working with Safeguard in chat tools. It sits alongside the Slack, Microsoft Teams and Discord apps, which already post alerts and take commands. With Tag, the conversation itself becomes the interface. You do not need to remember a command syntax or open another tab.
The Slack app page shows the pattern in one line: typing @safeguard search log4j returns the affected products, the reachability verdicts and the open work. Reachability matters here. It tells the channel whether your code actually calls the vulnerable function, so the thread does not fill up with theoretical risk.
What a team does with it
- Check exposure fast. When a new advisory lands, ask Safeguard which of your products carry the package, and which of those reach it.
- Look at a finding together. Slash commands such as
/safeguard finding 1234render a finding in the channel, so the engineer, the reviewer and the manager read the same facts. - Start a scan from the thread.
/safeguard scan owner/repokicks off a scan and the confirmation lands where the discussion is. - Record a decision. A waiver, such as
/safeguard waive CVE-2025-XXXX, is a deliberate act, and doing it in chat leaves a visible trail of who agreed. - Escalate what nobody answered. The Slack app page describes unacknowledged critical findings climbing your on-call chain: a direct message, then a channel ping, then a page.
The Teams app adds cards for critical findings, with the diff, the rule and a suggested fix, and buttons to approve, defer or escalate. Admins pin the app to the channels that own each product, so alerts reach the people who can act.
Why it matters
A finding that waits for someone to log in waits too long. When the question and the answer share a thread, the decision is faster and the reasoning is saved with it. It also helps the people who will never open a security dashboard, such as product managers and support leads, who still need an honest answer to a customer question.
How to run it well
- Connect the chat tool from Settings, then Integrations.
- Map each product to the channel of the team that owns it.
- Agree who answers in the thread, so a mention is never left hanging.
- Keep waivers to a short list of people.
- Review once a month which alerts nobody read, and remove them.
Quick check
Why ask in the channel instead of the console?
The answer, the reachability verdict and the decision all stay in one thread that the whole team can read.
What does reachability add to a mention like search log4j?
It separates products that merely contain the package from products whose code calls the vulnerable function.
