The Safeguard CLI scan command takes exactly one target per run: a local directory, a container image, a Git repository URL or an existing SBOM file. Use a directory for code on disk, an image for what you ship, a repository for something you have not cloned, and an SBOM when another tool already produced one.
The four forms
safeguard scan --dir .
safeguard scan --image nginx:latest
safeguard scan --repo https://github.com/org/repo
safeguard scan --sbom sbom.json
Pass two at once and the command will not do both, so run it once per target.
Directory
Best for developers and for CI jobs that already checked out the code. It reads manifests and lock files in the folder and builds the SBOM from what it finds.
Watch for: missing lock files and uninstalled dependencies, which give an incomplete SBOM. If the output looks thin, install dependencies first. For private or proprietary code there are options to tell the scan which namespaces are yours, so internal packages are not mistaken for public ones.
Container image
Best for what actually ships. An image contains operating system packages and language packages that a source scan never sees, such as a base image's libraries.
Watch for: tag drift, and credentials for private registries, which go in through the username and password options.
Repository
Best for scanning something you have not cloned, such as a third party library you are evaluating. Private repositories need a token option.
Watch for: you are scanning a default branch at a moment in time. Record the commit you meant.
SBOM
Best when a supplier handed you one, or another generator in your build made it. The scan takes the SPDX or CycloneDX file and matches it against vulnerability data without needing the source.
Watch for: the result is only as good as the file. If the SBOM was generated from a manifest range rather than resolved versions, the matches will be off. Validate it first with the validate command.
Choosing in practice
- Pull request check: directory.
- Release gate: image, plus directory for the application code.
- Vendor review: SBOM, and image if they ship one.
- Evaluating an open source library: repository.
Most mature setups run more than one, for example directory scans on every commit and image scans on every release build.
Useful options across targets
The usage docs list an output directory option, a scanner selection option, an option to resolve transitive dependencies, a format option for SBOM type and a verbose switch. Transitive resolution is off unless you ask for it, and it can slow large scans, so scan a subfolder first if you hit timeouts.
Quick check
Can I scan the image and the source in one command?
No. The scan command accepts one target at a time. Run it twice and keep both result folders.
Which target finds operating system package issues?
The container image target, because the image contains the operating system layers. A directory scan reads application manifests.
You can also see how an inventory looks in the interactive demo.
Click through it at your own pace, or open it full screen.
Safeguard also offers a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
