How to triage a critical vulnerability in VS Code with Safeguard

To triage a critical vulnerability in VS Code with the Safeguard extension, raise the severity threshold to critical, open the Vulnerabilities panel, read the hover summary on the flagged dependency, choose a remediation strategy and review the proposed version bump before you commit it. Then confirm the fix in the platform if you need reachability.

This walkthrough follows the extension's documentation. If a screen differs on your version, trust the docs and your extension's settings page.

What do you need first?

Install the extension from the VS Code Marketplace, by searching for Safeguard in the Extensions view. Cursor users install the same package from Open VSX. The extension activates when it finds a supported manifest such as package.json or go.mod, and it covers npm, Yarn, pnpm, pip, Poetry, Pipenv, Maven, Gradle, Go Modules, Cargo and Bundler.

Scanning of public packages works without signing in. Run "Safeguard: Login" if you want the backend features that need an account. Auto scan and scan on save are on by default.

Step 1: Narrow the view to critical

Open Settings and set safeguard.severityThreshold to critical. The default is low, which shows everything. With critical only, the Safeguard view in the activity bar becomes a short list you can finish in one sitting.

Open the Vulnerabilities panel. The same activity bar view also has SBOM, Compliance and Recommendations panels, which are useful later.

Step 2: Read before you change anything

Hover a flagged dependency in the manifest. The extension shows a summary of the issue. Read it for three things: which package and version, what the fixed version is, and whether the fix is a patch, a minor or a major jump.

A major jump deserves a pause. Check the changelog and your tests before accepting it.

Step 3: Choose a remediation strategy

The extension offers three strategies. Safe applies minor updates only. Balanced, the default, applies minor and patch updates. Aggressive goes to the latest version. Set one with "Safeguard: Set Remediation Strategy" or the safeguard.remediationStrategy setting.

For a critical finding on a production service, many teams start with Safe or Balanced, then move to Aggressive only if no smaller fix exists.

Step 4: Apply the fix and look at the diff

Click the lightbulb or press Ctrl+. (Cmd+. on a Mac), or run "Safeguard: Auto-Fix Vulnerability (Bump Version)". Look at the change in your manifest. Leave safeguard.autoFixOnSave off, its default, so nothing changes without you seeing it.

Then run your install and your tests. A version bump that compiles is not the same as one that behaves.

Step 5: Decide what to do with what remains

If a critical finding has no fix yet, you have options: pin and monitor, replace the library, or use "Safeguard: Ignore Vulnerability" with a written reason. Ignoring should be a decision with an owner, not a way to clear the list.

Where does reachability fit?

The IDE documentation does not describe reachability inside the editor. Reachability analysis lives on the platform, where the Vulnerabilities view shows Priority and Reachability columns, according to the docs. If a critical finding is expensive to fix, check there whether it is reachable before you commit to a risky upgrade. Reachability can return unknown for code that uses reflection or dynamic dispatch, and unknown should be treated as potentially reachable.

What to do

1. Install the extension and open a project with a supported manifest.
2. Set the severity threshold to critical.
3. Hover each flagged dependency and note the fixed version and jump size.
4. Pick a remediation strategy that matches the risk.
5. Apply the fix with the lightbulb and read the diff.
6. Run install and tests before committing.
7. For fixes with no safe path, check reachability on the platform and record any ignore decision with an owner.

Quick check

Sources

• Safeguard documentation: IDE support
• Safeguard documentation: Reachability analysis

Last reviewed: 18 October 2026.