Developer Tools
How to measure dependency lag across your repositories
Dependency lag is how far your pinned versions trail the latest releases. Here is a practical way to measure it per repo, track it over time and act on it.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
How do you make pip verify package hashes before installing?
Hash-checking mode makes pip refuse any download that does not match a hash you recorded. How to enable it, what it requires, and what it cannot prove.
Oct 19, 20264 min read
Developer Tools
How do you make a security scan a required check before merge?
Run the scan on every pull request, name the job, then mark it as a required status check in branch protection. Steps, pitfalls, and what skipped means.
Oct 19, 20263 min read
Developer Tools
How do you lock down GitHub Actions for a small team?
Five settings a small team can change this week to reduce GitHub Actions risk: token permissions, pinned actions, secrets, review and approvals.
Oct 19, 20264 min read
Developer Tools
How do you lock dependency versions in a legacy Java build?
Lock Java dependency versions with Gradle dependency locking or Maven dependencyManagement and the enforcer plugin so scans match what ships.
Oct 19, 20263 min read
Developer Tools
How do you lock Android SDK versions with Gradle lockfiles?
Turn on Gradle dependency locking, generate gradle.lockfile with write-locks, commit it, and update chosen modules on purpose. Steps and caveats inside.
Oct 19, 20263 min read
Developer Tools
Why does my IDE scan disagree with CI, and how do you align them?
IDE, CI and platform scans disagree when versions, databases, config or inputs differ. Align the scanner version, data build, policy and lockfile to match.
Oct 19, 20263 min read
Developer Tools
How do I keep pinned GitHub Actions up to date?
Pinning to a commit SHA stops silent changes but also stops updates. Dependabot can open pull requests for pinned actions. Setup and review habit.
Oct 19, 20264 min read
Developer Tools
How do you keep one noisy team from starving everyone else's scans?
Use per-tenant concurrency caps, fair queuing and quotas on expensive scan types so one busy monorepo cannot delay every other team's pipeline.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.