The Safeguard CLI keeps its sign-in token in ~/.scanner, deployment configuration in ~/.cli, and logs and local history in ~/.sg. Settings files are layered, with command line flags winning. To reset or uninstall, sign out, remove the binary, then delete those three folders.
The file map
From the configuration documentation:
- Sign-in token:
~/.scanner/token.json, readable only by you by default. - Deployment configuration (tenant, client, servers):
~/.cli/config.json. - Logs:
~/.sg/logs/safeguard.log. - Assistant and terminal settings:
settings.jsonfiles you edit directly.
The installation docs add that ~/.sg holds logs and local history, ~/.scanner the token, and ~/.cli the deployment configuration written by the init command. None of these hold anything the platform depends on.
How settings layer
For the settings files, the order from highest priority to lowest is:
- Command line flags
- A local settings file inside the workspace
- The workspace settings file
- The settings file in your home folder
- Built-in defaults
A repository's own settings only take effect after you run the trust command in that folder. The documentation says repository settings can never set sign-in, provider or server URLs, which stops a cloned repo from quietly redirecting your credentials.
That is a good design to know about before you scan code from an unfamiliar source.
Viewing and changing configuration
safeguard config show
This prints the current configuration, and exits non-zero if nothing is configured yet. The set command accepts only a short list of keys: tenant, client, auth server, API server, organization name and environment. Other keys are rejected.
Environment variables that matter
- The log directory variable moves the log file.
- The tools directory variable tells the CLI where to look for scanner binaries first.
- The credential store variable chooses between a file, the OS store, or automatic.
- Two variables disable the release check and self update.
- One variable stops the terminal opening a browser during sign-in.
Clean reset
Use this when sign-in or configuration is stuck:
safeguard logout --yes
safeguard config reset --yes
If that is not enough, delete ~/.sg and ~/.scanner, reinstall the CLI, run safeguard, and sign in again.
Full uninstall
safeguard logout --yes
rm "$(command -v safeguard)"
rm -rf ~/.sg ~/.scanner ~/.cli
On Windows, remove the folder under your local app data directory named Safeguard with the PowerShell remove command, and delete the same state folders in your user profile.
Do the logout first, so the session is revoked before the token file disappears.
Quick check
Is it safe to delete the state folders?
Yes, as far as the platform goes. The docs say removing them does not affect anything there. You lose local logs, history and the sign-in token.
Can a repository change which server my CLI talks to?
No. The documentation says workspace settings can never set sign-in, provider or server URLs, and they only apply after you trust the workspace.
You can look at a project without installing or configuring anything using the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
