IDE Support

Safeguard ships an IDE extension for VS Code and Cursor, and a separate plugin for JetBrains IDEs. Both scan your dependency manifests as you work, surface vulnerabilities inline, and offer AI-assisted fixes without leaving the editor. They're independently built and versioned, so feature coverage differs slightly between the two — this page calls out where.

Supported IDEs

The VS Code/Cursor extension and the JetBrains plugin are separate codebases with independent release cadences and version numbers — a version bump on one doesn't imply anything about the other.

Installation

VS Code

code --install-extension Safeguard-sh-Inc.SafeguardshIdeExtension

Or open Extensions (Ctrl+Shift+X / Cmd+Shift+X), search "Safeguard", and click Install.

Cursor

Cursor installs through Open VSX rather than the VS Code Marketplace:

cursor --install-extension Safeguard-sh-Inc.SafeguardshIdeExtension

Or open Extensions in Cursor, search "Safeguard", and click Install.

JetBrains IDEs

1. Open Settings/Preferences → Plugins.
2. Search "Safeguard" and click Install.
3. Restart the IDE.

You can also download the plugin ZIP from the JetBrains Marketplace page and install it via the gear icon → Install Plugin from Disk.

Authentication

Both the extension and the plugin authenticate with OAuth 2.0 device flow — there's no manual tenant ID entry required.

1. Run Safeguard: Login (Command Palette in VS Code/Cursor, or Tools → Safeguard → Login in JetBrains).
2. A browser tab opens at app.safeguard.sh/activate showing a verification code.
3. Sign in and approve the device.
4. Return to the IDE — your tenant ID is populated automatically and tokens are stored in the IDE's secure/encrypted credential storage.

Device codes expire after a fixed window (10 minutes per the extension's own documentation) — if authentication times out, just re-run Safeguard: Login. Public-package scanning works without logging in; some backend-dependent features require it — backend-verified Package Firewall verdicts (safeguard.packageFirewallUseBackend) and backend-sourced notifications (safeguard.surfaceBackendNotifications) are silently disabled or fall back to local/offline behavior when you aren't logged in.

The activation link carries the device code and IDE type as query parameters, for example:

https://app.safeguard.sh/activate?device_code=abc123&user_code=WXYZ&ide_type=vscode

You can copy this URL out of the login notification and open it on another machine or browser profile if the one the IDE launched isn't where you're signed in — approving it there completes authentication back in the original IDE. You can also be logged in on multiple IDE instances or devices at once: each holds its own token, so logging out of one doesn't affect the others.

Run Safeguard: Logout (or Tools → Safeguard → Logout in JetBrains) to clear stored credentials from the IDE's secure storage.

Supported package managers

Both the VS Code/Cursor extension and the JetBrains plugin scan the same manifest families:

In VS Code/Cursor, the presence of any of package.json, requirements.txt, pom.xml, go.mod, Cargo.toml, or Gemfile in your workspace activates the extension automatically.

Manual scanning

Both autoScan and scanOnSave default to on, but you can trigger a scan on demand:

• VS Code/Cursor: open the Command Palette (Ctrl+Shift+P / Cmd+Shift+P) and run Safeguard: Scan Project for Vulnerabilities (Ctrl+Shift+V / Cmd+Shift+V) for the whole workspace, Safeguard: Scan Current File for the open manifest, or Safeguard: Scan Selected Code for Vulnerabilities for a highlighted block.
• JetBrains: right-click a manifest file in the project tree and choose Safeguard → Scan File for Vulnerabilities, or use Tools → Safeguard → Scan Project for the whole project.

Viewing scan results

• VS Code/Cursor: open the Safeguard view from the activity bar for the Vulnerabilities, SBOM, Compliance, and Recommendations panels, or hover a flagged dependency inline for a quick summary and lightbulb fix. Right-click any panel and choose Export Report to save findings for an audit.
• JetBrains: open the Safeguard tool window (bottom panel) for a hierarchical vulnerability tree — expand a package to see its individual CVEs, and double-click one for full CVSS/CWE details. Vulnerable lines are also highlighted inline, color-coded by severity (red/critical, orange/high, yellow/medium, blue/low); hovering one shows a quick summary.

Package Firewall inline checks (VS Code / Cursor)

As you edit a manifest file, the extension checks each dependency you add against Safeguard's Package Firewall and flags anything that would be warned on or blocked — before you ever run install. This is a lighter-weight, editor-native companion to the install-time proxy described in Package Firewall; it evaluates the package name as you type it rather than intercepting a real install.

It catches three things:

• Typosquats — a name one or two edits away from a popular package (for example expres instead of express) triggers a "did you mean…" suggestion.
• Dependency / namespace confusion — a scoped package that shadows a popular unscoped name under an unrecognized scope is flagged.
• Known-malicious packages — names matching documented malicious packages are blocked inline.

Flags appear as ⛔/⚠ badges next to the dependency line, with a hover card and a full verdict in the details panel — the same annotation surface used for vulnerability findings.

Two settings control it:

This feature is documented for the VS Code/Cursor extension only. The JetBrains plugin's published documentation does not mention inline Package Firewall checks.

To require backend-verified verdicts (rather than the offline heuristic) for every dependency you add, set this in settings.json:

{
  "safeguard.enablePackageFirewall": true,
  "safeguard.packageFirewallUseBackend": true
}

Note that packageFirewallUseBackend requires you to be logged in — see Authentication.

AI-powered remediation

Both the extension and the plugin generate fix suggestions via one of three remediation strategies, set with safeguard.remediationStrategy (VS Code/Cursor) or the equivalent picker in the JetBrains quick-fix flow:

• VS Code/Cursor: hover a flagged dependency, open the lightbulb menu (Ctrl+. / Cmd+.), and choose a suggested fix, or run Safeguard: Auto-Fix Vulnerability (Bump Version) / Safeguard: Fix All Vulnerabilities. You can also set a default strategy in settings.json:

  {
    "safeguard.remediationStrategy": "safe"
  }

• JetBrains: place the cursor on a flagged dependency, press Alt+Enter (⌥↩ on Mac), select "Fix with Safeguard AI", pick a strategy, and review the change in the diff view before applying. To fix an entire package or project at once, open the Safeguard tool window, right-click the package or project node, and choose Fix All Vulnerabilities.

Interactive AI assistant (VS Code / Cursor)

The extension includes a chat panel (in the Safeguard activity-bar view) for asking security questions in natural language, analyzing selected code, and inserting suggested code at the cursor. Relevant commands and shortcuts:

Conversation history is tracked automatically, and the commands above let you start fresh, export, or clear a conversation, or insert a suggested snippet at the cursor. Example questions the assistant is designed to answer:

• "Why is this package vulnerable?"
• "What's the safest way to fix CVE-2024-12345?"
• "Should I upgrade React to v19?"

The JetBrains plugin's published documentation describes quick-fix intention actions and a vulnerability tool window, but not an equivalent interactive chat assistant.

Feature comparison

Commands reference (VS Code / Cursor)

All commands are registered under the Safeguard category in the Command Palette (Ctrl+Shift+P / Cmd+Shift+P). This is the full list contributed by the extension manifest:

Authentication

Scanning

Remediation

AI assistant

SBOM, compliance, and posture

Other

This command list comes from the extension's own manifest. The JetBrains plugin does not publish an equivalent full command list — its documented entry points are the Tools → Safeguard menu, the intention-action quick fixes (Alt+Enter), and the Safeguard tool window described above.

Settings reference (VS Code / Cursor)

Open Settings (Ctrl+, / Cmd+,) and search "Safeguard", or edit settings.json directly.

A minimal settings.json override for a stricter, self-directed setup — no backend Package Firewall, safe-only fixes, medium+ severity only:

{
  "safeguard.remediationStrategy": "safe",
  "safeguard.severityThreshold": "medium",
  "safeguard.autoFixOnSave": false,
  "safeguard.packageFirewallUseBackend": false
}

Common errors

Browser doesn't open for login. Copy the activation URL from the notification and open it manually.

"Authentication timeout" / device code expired. Device codes expire after a fixed window; just re-run Safeguard: Login and complete the browser approval before it lapses.

Scan completes with 0 vulnerabilities unexpectedly. Confirm the manifest file is syntactically valid and check that the configured service URLs are reachable, then trigger a manual scan — Safeguard: Scan Project for Vulnerabilities / Scan Current File in VS Code/Cursor, or right-click the file → Safeguard → Scan File for Vulnerabilities in JetBrains. In JetBrains you can also inspect Help → Show Log in Explorer/Finder for scan errors.

JetBrains plugin doesn't appear under Tools after installing. Restart the IDE fully, confirm the plugin's declared IDE-version compatibility under Settings → Plugins → Safeguard, and confirm JDK 17+ is configured under File → Project Structure → SDK.

Package Firewall isn't flagging anything. Confirm safeguard.enablePackageFirewall is true. If you expect backend-sourced verdicts rather than the offline heuristic, also confirm safeguard.packageFirewallUseBackend is true and that you're logged in.

Scans feel slow on a large project. Increase safeguard.cacheDuration (or the equivalent JetBrains cache-duration setting) so repeated scans hit the cache instead of re-querying, disable safeguard.autoScan/scanOnSave in favor of manual scans while doing bulk edits, and confirm the IDE can reach the configured Data Service URL — a slow or blocked network path is a common cause.

"Authentication expired" / "Invalid token" after working for a while. Log out and back in (Safeguard: Logout then Safeguard: Login, or the equivalent Tools → Safeguard menu items in JetBrains) to force a fresh OAuth exchange, and make sure your system clock is synchronized — OAuth tokens are time-sensitive.

Related

• Package Firewall — the install-time proxy and enforcement model the IDE's inline checks are a lightweight companion to.
• Griffin AI — the remediation and assistant engine behind IDE fix suggestions.
• Software Composition Analysis (SCA) — the broader vulnerability/license/malicious-package scanning the IDE extensions surface inline.
• Secrets Scanning — the capability behind the VS Code/Cursor Check Staged Commit for Secrets command.
• Asset Discovery — the capability behind the VS Code/Cursor Discover Assets command.
• SDKs — call the same findings and remediation APIs directly from your own tooling.