Security for Air-Gapped Environments.
A full software supply chain security platform that runs completely offline — built for the classified networks, defense contractors, and air-gapped infrastructure where cloud-only tools can't operate.
Built for Classified & Air-Gapped Environments.
Zero cloud dependency. Zero internet access. Complete security.
Air-Gapped Security
Software supply chain security that runs completely offline. Zero cloud dependency, no internet access required.
IL7-Ready & Classified Networks
Designed for defense contractors and federal agencies. Built to run in classified environments and air-gapped networks.
CI/CD Integration
Seamlessly integrate into Jenkins, GitLab CI, GitHub Actions, and any build pipeline. Exit codes for automation.
Fast Scans
Deep transitive dependency scanning, typically in a couple of minutes. Designed for minimal overhead on your build pipeline.
Purpose-Built Use Cases.
Designed for environments where cloud-based tools cannot operate
Defense & Aerospace
IL7 classified networks and air-gapped environments for DoD contractors
On-Premises Enterprise
Financial institutions and healthcare with strict data residency requirements
Offline Development
Remote sites, ships, aircraft, and field operations without internet connectivity
Simple Installation.
# Download and install
$ curl -sSL https://cli.safeguard.sh/install.sh | bash
# Run security scan
$ safeguard scan --depth 100 --offline
# Generate SBOM
$ safeguard sbom generate --format cyclonedx
# Integrate with CI/CD
$ safeguard scan --exit-code --fail-on critical
Six commands, one binary.
Everything the cloud platform does, scriptable from a terminal
safeguard scan
Full multi-scanner sweep with reachability and enrichment. Grype, Trivy, License scanner, Gitleaks, OSV, GHSA, Scorecard, Hipcheck, SonarQube, malicious-package detection, and SCC run in one pass.
safeguard sbom
Generate CycloneDX or SPDX from any project. Deterministic, sortable output that diffs cleanly across builds and survives reproducibility audits.
safeguard fix
Apply auto-fixes locally or open auto-fix PRs against the upstream repo. Each fix is annotated with the CVE it closes and the test plan it survived.
safeguard policy
Evaluate a policy locally before pushing. The same engine that runs in CI runs at your terminal, so policy failures never surprise you in pipeline.
Air-gapped mode
Works against an offline mirror plus an offline vulnerability DB. SCIF-friendly: bring the bits in on media, get the same verdicts as cloud users.
JSON / SARIF / human output
Pipe SARIF straight into GitHub Security, JSON into your custom dashboards, or read human output at the terminal. CI integration is one flag away.
Where the CLI earns its keep.
Pre-commit hook that fails on KEV CVEs
Setup · Drop safeguard scan --fail-on kev into .git/hooks/pre-commit.
Every commit attempt triggers a fast incremental scan over changed files. If a dependency introduces a CVE on the CISA KEV list, the commit aborts with a fix suggestion. Engineers never push a known-exploited bug.
KEV introductions blocked at commit time
Reproducible scans in a Docker build stage
Setup · Add safeguard scan and safeguard sbom to a builder stage.
The build emits a signed CycloneDX SBOM as a layer artefact. Downstream stages cosign-verify the SBOM before promotion. Every image carries its own provenance for compliance and incident response.
Signed SBOM on every image
Air-gapped audit in a SCIF
Setup · Install the static binary plus the offline DB bundle.
Run the full scanner stack inside a classified facility with no internet. Generate the same verdicts as cloud users, exit-code into the on-prem CI, and hand the SARIF to the auditor on physical media.
Identical findings, zero egress
CI smoke test on a fork before opening a PR
Setup · Run safeguard scan --diff origin/main locally.
Get the same verdict CI would produce, in seconds, against the diff you are about to push. Fix in place, rerun, and only open the PR once the gate is green. Reviewers stop wading through failed CI runs.
First-try PR pass rate up sharply
From install to CI gate.
Six stages turn a fresh terminal into an enforced security gate
- 01
Install
brew, npm, or a single static binary — pick what fits your platform.
- 02
Init config
safeguard init writes a versioned .safeguard.yml at the repo root.
- 03
Run scan
Eleven scanners execute in one pass and merge results by purl.
- 04
Reachability pass
Call-graph analysis prunes vulnerabilities that no live code path reaches.
- 05
Output SARIF / JSON / CycloneDX
Pick the format your downstream tooling expects, or emit all three.
- 06
Exit code drives CI gate
Non-zero on policy failure means your pipeline aborts before deploy.
One CLI. 373 Frameworks.
Pass --framework <flag> to evaluate dozens of jurisdictional and industry frameworks. Same engine, same evidence, same signed attestation — every time.
$ safeguard scan \
--framework fedramp-high,nis2,dora,dpdp-act,iso27001 \
--attestation cosign \
--sbom-format cyclonedx \
--fail-on amber
✓ SBOM emitted sg-sbom-cyclonedx.json
✓ Attestation signed sg-attest.intoto.jsonl
✓ Evidence ledger pushed audit/2026-05/
━━━ Framework verdicts ━━━
● FedRAMP HIGH GREEN 421/421 controls
● NIS2 GREEN 36/36 measures
● DORA GREEN 5/5 chapters
● DPDP Act 2023 AMBER 2 controls need review
● ISO/IEC 27001:2022 GREEN 93/93 controlsFramework flags by region. Full jurisdiction list on the compliance use case page.
IL7 & SCIF Ready
Same framework flags work offline against a mirrored vuln DB. Verdicts identical to cloud users.
Data Never Leaves
Evaluator and evidence ledger run entirely inside your boundary. Nothing egresses to Safeguard.
Sigstore By Default
Every SBOM and attestation cosign-signed. Auditors verify without trusting your CI or Safeguard.
Ready for Air-Gapped Security?
Join defense contractors and federal agencies securing classified environments
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.