In the Safeguard desktop app, filter your findings for reachable ones in the web view, open the finding, and ask the AI search in plain English why it is flagged. Use the local panel to re-scan the project folder and compare. Reachability labels come from analysis, so verify surprising results in the code.
This how-to follows the Safeguard download page and documentation as read on 18 October 2026. Where the docs do not describe a step, we leave it out.
What is the desktop app, in this context?
Safeguard's docs describe the desktop app as an Electron application for macOS, Windows and Linux that wraps the web app. The window has two views. On the left, about three quarters of the width, is the familiar web app at app.safeguard.sh. On the right is a local panel that can reach your filesystem, a local shell and MCP servers. Toggle the panel with Cmd+Shift+S on macOS or Ctrl+Shift+S elsewhere. The download page describes the app as a way to ask your supply chain anything in plain English.
The two views are isolated. The web app sees only a minimal detection and panel control interface and cannot read your files.
What does reachable mean here?
The Safeguard reachability documentation says a CVE is reachable when your code actually calls the vulnerable function or triggers the vulnerable code path. It describes static reachability from a call graph, dynamic reachability from what runs in production, and configuration reachability from framework settings. It uses four labels: reachable, conditionally reachable, unreachable and unknown, with unknown treated conservatively as potentially reachable.
The page also says analysis quality varies by language and ecosystem, and it carries a note that some of the REST endpoints it describes are not available yet. Read the language support table for your stack before you rely on a label.
How do you ask the question?
- Open the app, sign in in the left pane as you would in a browser and open your project.
- Use the global search bar, reachable with the slash key. The web application docs give this example filter: severity:critical AND reachable:true AND project:payments-service. Swap in your own project name.
- Open one result and note the package, the version and the fix version.
- Open the AI search and ask in plain language, for example why this finding is marked reachable and which code path leads to it. The browser extension docs describe the same AI search experience at app.safeguard.sh/portal/search.
- Treat the answer as a lead. Open the file it names and read the call.
If the label is conditional, the docs say a path exists but needs a feature flag, route or configuration that is not currently enabled. Ask what would turn it on.
Where does the local panel help?
The panel's Scan tab lets you add a local project folder, run a vulnerability scan on it, view results grouped by severity and toggle auto scan per project. You grant folder access through the operating system's file picker, and the app can only read folders you have granted. This is useful when you have just changed code and want to see if the finding persists before pushing.
The docs say scanning runs locally. The Terminal tab can run an allowlist of commands, including the Safeguard CLI and git, inside granted folders. We do not describe what the panel shows for reachability specifically, because the docs we read list severity grouping only.
What are the limits?
Reachability is an analysis, not a proof. Dynamic and configuration signals depend on collectors and configuration being present. Reflection and dynamic dispatch can lead to unknown. And an unreachable label today can change after a refactor, so re-check after major changes.
What to do
- Install the desktop app from the download page and sign in.
- Filter your findings for reachable ones in your project.
- Open one finding and ask the AI search why it is flagged.
- Read the code path it names in your editor.
- Grant the project folder in the panel and re-scan after any change.
- Record the decision and re-check after major refactors.
Quick check
Does the desktop app give the web app access to my files?
No. The docs say the web view sees only a minimal detection and panel control interface. Only the local panel can reach folders you grant.
What does unknown mean?
The analyzer could not decide, for example with dynamic dispatch or reflection. The docs say it is treated conservatively as potentially reachable.
Sources
- Download Safeguard, read 18 October 2026
- Desktop Application, Safeguard Docs, read 18 October 2026
- Web Application, Safeguard Docs, read 18 October 2026
- Vulnerability Prioritization and Reachability, Safeguard Docs, read 18 October 2026
- Browser Extension, Safeguard Docs, read 18 October 2026
Last reviewed: 18 October 2026.
