A security tool can reach developers through a desktop app, a command line tool, editor extensions, a browser extension and mobile apps. Ask which of these are generally available today, what each one does, and whether they all use the same rules, so results never disagree between surfaces.
What a "surface" is
A surface is a place where a person meets the product. Common ones are the web console, a command line tool, an editor plugin, a pull request check, a browser extension and a mobile app. More surfaces mean more places a developer can see a problem early, and more places for inconsistency to creep in.
The questions
| Surface | What to ask |
|---|---|
| Command line | Which operating systems, how is it installed, can it run headless in CI? |
| Editor extension | Which editors, local or remote scanning, same findings as CI? |
| Browser extension | What does it inspect, which permissions does it need? |
| Desktop app | Is it a full client or a viewer? Does it update itself? |
| Mobile app | Read only alerts, or can you act? |
| Pull request integration | Status check, comment, or both? |
Add one more question to every row: "Is this generally available, or in preview or early access?" Vendors place roadmap items on feature lists in the same font as shipped ones. Ask for a download link or a documentation page you can open today.
Consistency beats count
Five surfaces with five different rule sets are worse than two that agree. Ask whether policies are defined once and applied everywhere. If a developer fixes something flagged in the editor, the pull request check should agree it is fixed. See editor checks versus CI for how to divide responsibilities.
Check the installers themselves
A security tool is software you install on developer machines, which makes it part of your own supply chain. Ask how binaries are distributed, whether they are signed, how updates are verified, and where the extension is published. For browser add-ons, review the permission list as described in auditing Chrome extension permissions in five minutes.
A one afternoon evaluation
- List the surfaces on the vendor's page.
- For each one, mark it as installable now, preview, or not available.
- Install the three your team would use most.
- Scan the same project through each and compare findings.
- Note any disagreement and ask the vendor to explain.
- Ask your developers which one they would keep and which they would remove.
Skip surfaces nobody on your team will use. A mobile app matters to an on-call manager and not to a developer at a desk, and the reverse is true of an editor plugin.
Try it yourself
Click through it at your own pace, or open it full screen.
Notice how a security check appears inside an assistant workflow, which is another surface worth asking about.
Quick check
How many surfaces does a team really need?
Usually two or three: the pull request check, one editor or CLI path, and a console for managers.
Is a browser extension a security tool or a risk?
Both can be true. Review its permissions and publisher like any other software you approve.
Safeguard lists its generally available surfaces on its download page, including Desktop, CLI, VS Code, JetBrains, Open VSX, browser extensions, iOS and Android. Try the free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
