DUBLIN, California, October 10, 2026. Safeguard today published a practical guide for security and engineering leaders deciding whether to send source code or data to a large language model vendor, together with a plain statement of how Safeguard handles its own customers' code. The guide sets out ten questions to ask any AI vendor before code or data leaves an organization's control, covering license grants, training use, retention, sublicensing, revocation, subprocessors, region, zero-retention options, enterprise versus consumer terms, and opt-out.
The guide follows industry discussion of Anthropic's OSS Scanner, an opt-in service announced on October 8, 2026 that scans open-source projects for vulnerabilities at no cost. Maintainers enroll a project through a pull request, and the program's repository asks contributors to sign a Contributor License Agreement. Section 2 of that agreement grants Anthropic and recipients of software it distributes "a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Your Contributions and such derivative works." Anthropic describes OSS Scanner as an opt-in vulnerability scanner for open-source projects, informed by its experience using Claude to find vulnerabilities, with reports generated by its strongest Claude models, including Claude Mythos.
The agreement closely follows the Apache Software Foundation's contributor agreement. It applies to "Contributions" as it defines them, and it states that contributors keep all other rights in their work. The separate OSS Scanner Agreement incorporates Anthropic's Consumer Terms of Service, which address the use of materials for model training.
Safeguard credits a LinkedIn post by a security practitioner, which raised concerns about the scope of that grant. Safeguard's guide reviews which of those concerns the published documents support and which remain open questions for Anthropic to answer. It also recognizes that free scanning can help open-source maintainers who have no security budget.
Safeguard's commitments on customer code
Safeguard's published terms and data pages state that:
- Customers retain all rights to the data they upload, and Safeguard's license is limited to processing that data to provide the service.
- Customer source code is processed transiently during a scan and is not added to model training corpora.
- Customers can export their data at any time, and data is deleted within 30 days after an account ends unless the law requires otherwise.
- The Safeguard local runner performs dependency scans on the customer's own machine and sends the findings, not the source tree.
- Safeguard can be deployed on-premises or fully air-gapped, with its models included.
The full guide, including the ten questions and the documents it draws on, is available on the Safeguard blog: Before you send code to an AI vendor, read the license you grant.
About Safeguard
Safeguard is an AI-native software supply chain security platform. It maintains a registry of curated zero-CVE components across ten ecosystems, discovers Zero Days through reachability and taint analysis deep in the dependency tree, and authors remediation directly against the affected code. Safeguard is headquartered in Dublin, California. Pricing is public and self-serve from $0 at https://safeguard.sh/pricing.
Media contact: press@safeguard.sh
