In Cursor, install the Safeguard extension from the Open VSX registry, sign in, scan the project, open the Vulnerabilities panel, hover the flagged dependency, apply a fix with the strategy you choose and test the result. The steps below follow Safeguard's IDE support docs; confirm the names in your installed version.
How do you install and sign in?
The docs say the same extension package serves VS Code and Cursor, with Cursor installing from the Open VSX Registry. Search for Safeguard in the Extensions view, or use the Cursor command line extension install with the package name Safeguard-sh-Inc.SafeguardshIdeExtension. The docs list version 5.1.0 for the extension at the time of our review.
Run the command Safeguard: Login. It uses an OAuth device flow: approve the code in the browser at app.safeguard.sh/activate. Public package scanning works without login, but backend Package Firewall verdicts and notifications need it. The extension activates when the workspace contains a manifest such as package.json, requirements.txt, pom.xml, go.mod, Cargo.toml or Gemfile.
How do you find the critical issue?
autoScan and scanOnSave are on by default. To scan on demand, run Safeguard: Scan Project for Vulnerabilities, with the shortcut Ctrl or Cmd plus Shift plus V, or Safeguard: Scan Current File.
Open the Safeguard view in the activity bar. It has Vulnerabilities, SBOM, Compliance and Recommendations panels. The docs say the severityThreshold setting defaults to low; raise it if you want the panel to focus on the highest items.
Hover a flagged dependency for a summary and the lightbulb fix. Before you change anything, answer three questions: is it a direct or transitive dependency, is a fixed version available, and is the vulnerable code used by your project? The IDE docs do not describe reachability; for that, use the Vulnerabilities tab in the web app, where Safeguard shows a Reachability column.
How do you fix it?
Pick a remediation strategy. The docs describe three: Safe, which applies minor updates only; Balanced, the default, which applies minor and patch updates; and Aggressive, which moves to the latest version. For a critical finding with a patch release available, Balanced is usually the right start. If the only fix is a major version, expect code changes and plan time.
Apply the fix with the lightbulb, using Ctrl or Cmd plus a period, or run Safeguard: Auto-Fix Vulnerability (Bump Version). To fix everything at once, run Safeguard: Fix All Vulnerabilities, but for triage of one critical item, fix just that one so the diff is reviewable. The autoFixOnSave setting is off by default, which is sensible for a first run.
Then run your tests and review the lockfile diff.
What else can the extension check?
For security questions there is an AI assistant panel. Open it with Safeguard: Open AI Assistant, or select code and run Safeguard: Analyze Selected Code. Treat its answers as a second opinion and verify them.
Package Firewall inline checks flag typosquats, dependency or namespace confusion and known malicious packages as you edit manifests, with warning badges next to dependency lines. They are on by default in VS Code and Cursor; backend verdicts are optional and need login.
Before you commit, run Safeguard: Check Staged Commit for Secrets. To save evidence for a ticket, use Export Report, or Safeguard: Export SBOM for a CycloneDX or SPDX file.
See it on its own page: Fix available now demo.
What can go wrong?
If the panel shows zero vulnerabilities unexpectedly, the docs say to check that the manifest is valid and that the service URLs are reachable, then run a manual scan. If the login window does not open, copy the activation URL from the notification. If the device code expires, run Login again.
A version bump can break code. Treat the fix as a proposal, run tests, and read release notes for major changes. And a critical score does not by itself tell you urgency; check exploitation data for context.
What to do
- Install the extension from Open VSX and run Safeguard: Login.
- Scan the project and open the Vulnerabilities panel.
- Identify the critical item, whether it is direct, and the fixed version.
- Apply a Balanced fix for that item only.
- Run tests and review the lockfile diff.
- Run Check Staged Commit for Secrets before committing.
- Export the report or SBOM for the ticket.
Quick check
Does the extension work in Cursor?
Yes. The docs say it is the same package as VS Code, installed from the Open VSX Registry.
Which fix strategy should I use for a critical issue?
Start with Balanced, which applies minor and patch updates. Use Aggressive only with time to test.
Sources
Last reviewed: 18 October 2026.
