Developer Tools
How to announce a security release of an internal library
A security release notice should say what changed, who is affected, what to do and by when. Template and channel advice for internal library owners.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
How do you allow only trusted build scripts in pnpm?
pnpm 10 does not run dependency postinstall scripts by default. Keep that on, and allow builds one package at a time with an explicit list you review.
Oct 19, 20263 min read
Developer Tools
How do you add a fresh clone build check to CI?
A fresh clone build catches files and settings that live on one developer machine. Add one CI job that clones clean, installs frozen, builds uncached.
Oct 19, 20264 min read
Developer Tools
How slow can a security scan be before developers work around it?
There is no universal number, but there is a method: set a time budget per stage, measure it, and move slow checks off the pull request path.
Oct 19, 20263 min read
Developer Tools
How should failed scan jobs retry? Backoff, dead letters and idempotency
Retry scan jobs only for transient failures, with exponential backoff and jitter, a hard cap and a dead-letter queue. Make every job safe to run twice.
Oct 19, 20264 min read
Developer Tools
How should a security bot comment on a pull request?
A security bot should comment rarely, on the changed line, with the risk, the fix and a way to dismiss. Here is the comment design that developers read.
Oct 19, 20264 min read
Developer Tools
How should a sandboxed store widget talk to your page safely?
Isolating a vendor widget in a frame works only if messages between frame and page are checked. Learn the postMessage pattern and the origin check to include.
Oct 19, 20264 min read
Developer Tools
How should a library deprecate an API? What SemVer says
SemVer says to update the docs and ship a minor release with the deprecation, then wait at least one minor release before removing it in a major release.
Oct 19, 20264 min read
Developer Tools
How do scheduled tasks work in Claude, ChatGPT and Codex?
A side by side of where scheduled tasks run, what triggers them and how permissions work in Claude, ChatGPT and Codex, from the vendors' own documentation.
Oct 19, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.