Developer Tools
Hosted or self-run dependency update tool: how do you decide?
Hosted update tools are quick to adopt. Self-run ones give control of timing, network reach and credentials. A guide to the questions that count.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
What does brew pin do, and does it stop a package updating?
brew pin stops brew upgrade from changing a package, but dependencies can break and self-updating casks can still change. Know the tradeoff before pinning.
Oct 19, 20263 min read
Developer Tools
Hermetic build vs reproducible build: what is the difference?
A hermetic build isolates the build from the host. A reproducible build gives identical bytes from the same inputs. They help each other but differ.
Oct 19, 20264 min read
Developer Tools
What can a Helm post-renderer see and change in your manifests?
A Helm post-renderer receives every rendered manifest and returns the final ones. Learn what that power allows, and how to review it safely.
Oct 19, 20264 min read
Developer Tools
Are Helm plugins safe to install? What to check first
A Helm plugin is an executable that runs with your permissions and can be written in any language. Here is how to vet one before it joins your toolchain.
Oct 19, 20264 min read
Developer Tools
Can kubeVersion stop a shared Helm chart installing on old clusters?
The kubeVersion field in Chart.yaml makes Helm fail an install on unsupported Kubernetes versions. How to set it for a shared chart and what it cannot do.
Oct 19, 20264 min read
Developer Tools
How do I bump a Helm chart dependency and keep it reproducible?
Helm dependency update pulls charts that satisfy Chart.yaml and writes a lock file for exact rebuilds. Steps to bump a subchart for a security fix.
Oct 19, 20264 min read
Developer Tools
Helm chart version vs appVersion: which one do you bump?
In Chart.yaml, version is the chart's own SemVer and appVersion is informational. Which to bump for template changes, app upgrades and shared charts.
Oct 19, 20264 min read
Developer Tools
Helm Chart.lock: keep chart dependencies the same in every cluster
Helm dependency build rebuilds charts from Chart.lock without renegotiating versions, which keeps dev, staging, and prod clusters on the same subcharts.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.