Developer Tools
What does FastAPI's OAuth2PasswordBearer actually check?
OAuth2PasswordBearer reads the Authorization header and returns 401 if absent. It does not validate the token or create the login route. What to add.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
How do you require auth on every FastAPI route?
Pass an auth dependency to FastAPI(dependencies=[...]) or to an APIRouter so every route inherits it. Why that beats adding it per route, and what to test.
Oct 19, 20263 min read
Developer Tools
Express vs Fastify defaults for request limits: which are stricter?
A side by side table of documented defaults for body size, params, trust proxy, timeouts and proto handling in Express and Fastify, and what to set.
Oct 19, 20264 min read
Developer Tools
How do you export an SPDX SBOM from GitHub for a data room?
Export the repository dependency graph as an SPDX file from the Insights tab or an Actions workflow, then date it, name it and note what it covers.
Oct 19, 20263 min read
Developer Tools
A developer says 'we never call that code'. How do you check?
When a developer says a vulnerable function is never called, turn the claim into a check: find the entry points, trace the calls, and record the result.
Oct 19, 20263 min read
Developer Tools
How do you explain OIDC instead of stored keys in CI to a buyer?
Plain words for a security reviewer: CI proves who it is and gets a short lived token, so no long lived cloud key sits in your pipeline secrets.
Oct 19, 20264 min read
Developer Tools
What exit codes should a security CLI return in CI?
Use distinct exit codes for clean, findings found and tool error, so a pipeline never mistakes a crash for a pass. A short design guide for CLI authors.
Oct 19, 20264 min read
Developer Tools
Exclude a folder from scanning or suppress the finding?
Exclude a path when code never ships, like fixtures and samples. Suppress a finding when code ships but one issue does not apply. How to choose.
Oct 19, 20263 min read
Developer Tools
What time does a vulnerability exception expire? Timezone rules
Store exception expiry as a UTC timestamp, show local time and define start or end of day. This avoids arguments, surprise build breaks and confusion.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.