Not as a timer. The Safeguard VS Code extension scans when you open a project and when you save a manifest, and it can be triggered by hand. It documents no scheduler. If you need scans at fixed times, schedule the Safeguard CLI in CI, or use recurring tasks in the desktop app, which is in early access beta.
What triggers a scan in the extension?
From Safeguard's IDE docs, two settings are on by default: autoScan scans the project when it opens, and scanOnSave re-scans manifest files when you save. A debounce delay of 2000 milliseconds waits after you stop typing before scanning. Scan results are cached for one hour by default, so repeat scans in that window reuse results.
You can also scan on demand with Safeguard: Scan Project for Vulnerabilities, which has the shortcut Ctrl+Shift+V or Cmd+Shift+V, Safeguard: Scan Current File, or Safeguard: Scan Selected Code for Vulnerabilities.
There is also a notification poll. A setting called backendNotificationPollSeconds, default 60 with a minimum of 15, controls how often the extension polls for server-side events such as critical findings or scan completion, and those show as IDE notifications when you are logged in. That is event delivery, not scan scheduling.
Which settings should you change?
Open Settings, search "Safeguard", or edit settings.json. These are the documented knobs that change how often work happens:
| Setting | Default | Effect |
|---|---|---|
| safeguard.autoScan | true | Scan on project open |
| safeguard.scanOnSave | true | Re-scan manifests on save |
| safeguard.scanDebounceDelay | 2000 ms | Wait before scanning after typing stops |
| safeguard.cacheDuration | 3600000 ms | How long results are cached |
| safeguard.batchSize | 10 | Packages scanned in parallel |
| safeguard.notifyOnNewVulnerabilities | true | Notify on new findings |
Safeguard's troubleshooting advice for slow scans on large projects is to raise the cache duration, turn off autoScan and scanOnSave during bulk edits in favor of manual scans, and check network access to the data service.
How do you get real scheduled scans?
Pick the option that matches where you want the schedule to live.
In CI with the CLI. The CLI page shows installing in a pipeline job, scanning the working tree and gating on the output files. Add a schedule trigger to that workflow so it also runs nightly, even when nobody pushes. A sketch for GitHub Actions, adapted from the pattern on the CLI page:
on:
schedule:
- cron: "0 3 * * *"
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install the CLI
run: curl -fsSL https://cli.safeguard.sh/install | bash
- name: Scan the working tree
run: safeguard scan --dir . --output out/
Check the CLI page for pinning a version and for how results are read. A schedule catches new advisories against code that has not changed, which is exactly what a save-triggered scan misses.
With a runner. The CLI page says that for scans the platform schedules, you register a runner instead. The runner claims jobs queued for your tenant, runs them on your machine and returns results without source.
With desktop recurring tasks (beta). The desktop docs describe a Tasks tab where you can schedule a task on a fixed interval, written as a number and a unit such as 24h, with each task individually enabled, disabled or deleted. Their example is re-scanning granted project folders daily and flagging new critical findings. This runs only while the desktop app is running.
Why not rely on the extension alone?
A save-triggered scan checks code you are touching. A dependency you shipped last month can become vulnerable tomorrow without any edit on your side. Editor scans give fast feedback while you work. Scheduled CI or runner scans give coverage while you sleep. Use both.
What are the limits?
Our claims stop at what the docs state. The extension's docs do not describe a built-in timer, and we did not test one. Also, the desktop app's scheduled tasks depend on the app staying open, and the app is in beta.
What to do
- Keep autoScan and scanOnSave on for fast feedback in the editor.
- Set severity threshold to your team's floor so notifications stay useful.
- Add the CLI scan to a nightly CI workflow.
- Review the CI results where your team already looks.
- For private networks, register a runner for platform-scheduled scans.
- Try desktop recurring tasks if you want a local daily check, knowing it is in beta.
- Revisit the schedule when you add new repositories.
This demo shows the in-editor view that the extension gives you while you work.
Quick check
Does the extension scan on a timer?
The docs describe scanning on open, on save and on demand. They document no timer.
Where should nightly scans run?
In CI with the CLI, on a registered runner, or as a desktop recurring task. CI is usually the most dependable because it does not depend on a laptop being open.
Sources
Last reviewed: 18 October 2026.
