Safeguard Local Runner Guide: Scan and Fix on Your Own Machine
The Safeguard local runner is built into the CLI. It runs scans and assistant turns on your machine and uploads only SBOMs and findings, never source.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
The Safeguard local runner is built into the CLI. It runs scans and assistant turns on your machine and uploads only SBOMs and findings, never source.
Solo developers can install the Safeguard CLI in minutes, fix vulnerable dependencies with approval, review changes before a push and check in by phone.
Small dev teams can run Safeguard with no security hire: the CLI on every laptop, scoped roles, a CI gate on each pull request and approvals by phone.
Put the Safeguard CLI on laptops, CI runners and build hosts, fail builds on findings or gates, scan images and IaC, and keep source on your machines.
Agencies can run Safeguard per client folder: fix vulnerable dependencies with approval, scan images, hand over validated SBOMs and keep client code local.
Use the Safeguard desktop app on Windows, macOS or Linux to pick up CLI sessions, send fixes to a folder, approve each step and scan local projects.
Use Safeguard hosted, with nothing installed: the cloud computer, cloud browser and Cloud CLI from one sign-in, plus how to mix them with your own devices.
The Safeguard Cloud CLI runs on Safeguard's infrastructure, so there is nothing to install. How to start it, what to use it for and when to go local.
Power user tips for the Safeguard CLI: settings, session flags, approval modes, checkpoints, local scans, CI steps and sending work from your phone.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.