Web Application

The Safeguard web app at app.safeguard.sh is the primary interface to every product. It runs in any modern browser and requires no installation.

URL and Access

Single sign-on: SAML 2.0, OIDC, and OAuth "social" login (Google, Microsoft, GitHub) are supported for Enterprise tenants. Configure under Settings → Authentication → Single Sign-On — see SSO Authentication Setup for provider-by-provider steps.

What's in the Web App

Every product is a section of the same app:

• ESSCM — SBOM generation, vulnerabilities, policies, attestation, code quality, findings, auto-fix.
• Portal — centralized SBOM management and secure sharing with third parties.
• TPRM — vendor inventory, questionnaires, SBOM-backed vendor assessment.
• OSM — open source intelligence, Gold registry, package security.

A global search bar (/ shortcut) runs queries across all products using the asset graph (see Asset Discovery). It accepts the same filter and boolean syntax as the ESSCM Search page, so a query like:

severity:critical AND reachable:true AND project:payments-service

narrows results to critical, reachable vulnerabilities in a specific project without leaving the bar. Plain text (a package name, a CVE ID) works too — see Search for the full operator list.

Scanner Icons

Every Safeguard security engine now renders its own distinct icon instead of falling back to a generic Git icon. DAST, SAST, Red Team, AI-SPM, DSPM, Runtime, Package Firewall, Endpoint, CTEM/EASM, SSPM, ITDR, DLP, and DRP each get their own icon, shown consistently in scanner cards on project pages, in the integrations list, and in finding provider modals. Previously, a project connected only over Git could show the same generic Git icon for findings that actually came from unrelated engines (for example, a DAST finding); now the icon on a card or finding tells you at a glance which engine produced it, without needing to read the label. See Unified Findings & Feature Flags for how these engines' findings are combined into one model once produced.

Supported Browsers

The app is a Progressive Web App (PWA). On desktop, install it via the browser's "Install app" prompt for a standalone window and faster launch.

Mobile Web

The app is responsive for tablets and phones. Mobile coverage is focused on review and notification workflows:

• Reviewing and approving Griffin-proposed remediations.
• Acknowledging alerts.
• Reading findings and advisories.
• Approving exceptions.

Heavy operations (writing workflows, editing policies, deep SBOM inspection) are best done on desktop.

Authentication

• Email + passkey (default).
• TOTP or hardware security keys (WebAuthn) for high-assurance — see MFA.
• SSO (SAML, OIDC, or OAuth social login) for Enterprise — see SSO Authentication Setup.
• Break-glass local accounts for emergency access, disabled by default — see Break-Glass.

Sessions expire after 8 hours (idle) or 24 hours (absolute) by default; Enterprise tenants can tighten these. Signing in through SSO doesn't change these session rules — the SSO handshake only establishes the session; expiry, idle timeout, and re-authentication for sensitive actions behave the same as a password/passkey session. Programmatic access (CI jobs, scripts, agents) uses a separate credential rather than a browser session — see API Keys and Tokens.

Real-Time Updates

The web app uses WebSocket and Server-Sent Events for live updates:

• New vulnerabilities appear without a reload.
• Griffin remediation progress streams as the model works.
• Workflow runs show step state in real time.

Performance

• Initial bundle size ~180 KB gzipped for the shell; product modules lazy-load.
• P95 time-to-interactive under 2.5 seconds on a 4G connection.
• Pages cached via stale-while-revalidate; re-authentication is automatic on token rotation.

Offline

The web app is not designed for offline use. For offline and air-gapped workflows, use the Desktop Application.

Keyboard Shortcuts

Accessibility

• WCAG 2.2 AA conformance.
• Full keyboard navigation.
• High-contrast and reduced-motion themes.
• Screen reader support for all data tables.

Data Residency

• US tenancy — data stored in us-east-1 and us-west-2.
• EU tenancy — data stored in eu-west-1 and eu-central-1.
• Government tenancy — data stored in AWS GovCloud or Azure Government.

Tenancy is chosen at signup and cannot be changed without a data-migration engagement.

FAQ & Troubleshooting

I was signed out with no warning in the middle of a session. Sessions expire after 8 hours idle or 24 hours absolute by default (see Authentication) — this is enforced regardless of activity in another tab. If it's happening sooner than expected, check whether your Enterprise tenant has tightened these limits, or whether an admin revoked your session directly (deprovisioning revokes all active sessions immediately — see Deprovisioning).

The app shows a banner saying my browser isn't supported, but it seems to mostly work. Anything below the minimum versions in Supported Browsers may render and function partially, but isn't tested and can break silently on newer features (for example, WebGPU-backed dashboards on Firefox). Upgrade to at least the listed minimum version, or switch to Chrome/Edge for guaranteed parity.

A finding, scan result, or workflow status I know just changed isn't showing up without a manual reload. The web app relies on a live WebSocket/SSE connection for the updates described in Real-Time Updates. If that connection has dropped (flaky network, corporate proxy interference, a laptop resuming from sleep), the page can fall behind until it's re-established. A manual reload always pulls current state directly, regardless of the live connection's status.

My global search / asset graph query returns nothing, but I expect matches. Check the query against the Search syntax reference — stacking multiple filters (e.g. severity:critical AND project:payments-service) narrows results to items matching every condition, so an overly-narrow combination can under-match. Also confirm the asset is actually onboarded — an unconnected repository or an image with no SBOM won't appear (see Shadow Asset Detection).

Our tenant is provisioned in the wrong region — can we just move it? No, not as a self-service action. Tenancy (US, EU, or Government) is fixed at signup per Data Residency because it determines where data is physically stored. Moving requires a data-migration engagement — contact Safeguard support to scope it.

Related

• Desktop Application — native app for local projects and offline.
• MCP Server — use the same capabilities from Claude or ChatGPT.
• API Reference — programmatic access.
• CLI — command-line access.
• SSO Authentication Setup — step-by-step SAML/OIDC/OAuth provider configuration.
• RBAC, Teams & Organizations — roles, MFA, API keys, sessions, and deprovisioning.
• Asset Discovery — what the global search bar and asset graph query.
• Unified Findings & Feature Flags — how scanner engine findings are consolidated and browsed.