Ways to access Guardian

There are five ways to reach Guardian. Four of them run entirely on hardware you control, and the fifth does not exist yet. This page says which is which, and what each one needs from you.

Compare methods

Guardian access methods compared by intended user, account requirement, network requirement, data location and status
Method	Intended user	Account	Internet	Data location	Status
Local CLI	Developers and automation	No account is involved in a local scan	Not required — the scan help states scans never use the network	Your machine	Verified
macOS application	Developers who prefer a graphical interface	Not documented — no verified release exists	Not documented — no verified release exists	Your machine	Blocked
Your CI/CD pipeline	Engineering teams enforcing a release gate	Whatever your CI provider already requires	Whatever your CI environment already does	Your own CI runner	Preview
Generated reports	Developers, QA, security reviewers and release managers	None for a locally generated report	Not required to generate or open one	The output path you choose	Verified
Sanitized findings sharing	Teams that choose connected collaboration	A separate product, with its own account	Required, only if you enable it	Only findings you have inspected and approved	Planned

How Guardian reaches a project

You point it at a local project.
A directory that already exists on your machine or on your CI runner. Guardian does not fetch anything and does not ask where your code is hosted.
It detects the project structure.
Flutter, native iOS or native Android, and which analysis paths apply to what it found.
It reads the files the enabled checks need.
Project manifests, platform and release configuration, dependency declarations and source. Nothing is transmitted to read them.
It writes findings and a report locally.
To the path you choose. The report is a file you own from the moment it exists.
Sharing is a separate, explicit decision.
Nothing leaves the machine unless you send it. There is no automatic upload of any kind.

What Guardian never asks for

Normal scanning needs none of the following. If something claiming to be Guardian asks you for any of them, that is worth a second look.

Source code upload
APK or IPA upload
Signing certificates or signing keys
Provisioning profiles
Environment secrets or API tokens
Production database credentials
Production database rows
Raw reports sent anywhere automatically

Method by method

Local CLI

Verified

The command surface is verified from the bundled CLI’s help output. How the CLI is distributed is not yet public.

You point the CLI at a project directory that already exists on your machine.
It detects the project structure, runs the enabled analyzers over local files, and writes findings and a report locally.
There is no upload step in a scan, and no account to create.
A public installation route has not been published yet. If you already have the CLI, the getting-started guide shows how to confirm it works.

Confirm an installed CLI

macOS application

Blocked

Release verification is in progress. There is no download.

The macOS application is a native front end that calls the same local engine through a JSON boundary, which keeps the CLI as the source of truth.
Its distribution build is completing signing, notarization and Gatekeeper verification. We publish a download when those pass, and not before.
System requirements and architecture support will be published with the first verified release, so the numbers you read are the numbers that shipped.

Release status

Your CI/CD pipeline

Preview

The commands are verified. The installation step inside CI is not, so the templates mark it explicitly.

Guardian runs inside the runner you already control. It is the same CLI, invoked by your pipeline.
Nothing is sent to a Guardian service. Your CI provider still processes your repository under your own configuration — that is your existing arrangement with them, not something Guardian introduces.
The templates leave the installation step clearly marked, because a public installation route has not been published.

CI/CD templates

Generated reports