Developer Tools
Does npm audit check devDependencies?
npm audit checks devDependencies unless you omit them. See how the omit setting changes what is sent to the registry and what it means for results.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Does locale or timezone change your build output?
Yes. Locale affects sort order, date format and encoding, and timezone affects time output. Set LC_ALL and TZ in the build script so every machine agrees.
Oct 19, 20263 min read
Developer Tools
Does installing a Python package run code? Source distributions explained
pip can run arbitrary code from a source distribution during install. The only-binary option refuses source builds. What that protects and what it breaks.
Oct 19, 20263 min read
Developer Tools
Does go test run fuzz seed corpus entries by default?
Yes. Plain go test runs every seed corpus entry as a unit test and fuzzes only with the fuzz flag. Failing inputs in testdata act as regression tests.
Oct 19, 20264 min read
Developer Tools
Does go.mod list everything in a Go build for your SBOM?
go.mod records required modules, but a binary only contains what the build used. Learn where each source helps and how to cross check a Go SBOM.
Oct 19, 20264 min read
Developer Tools
Does gh auth login store your GitHub token in plain text?
By default the GitHub CLI saves your token in the system credential store. It can fall back to a plain text file, so check how your machine stores it.
Oct 19, 20264 min read
Developer Tools
Does file order change your build output? Sorting inputs
Most filesystems do not guarantee file listing order, so archives and linked outputs can differ between runs. Sort inputs with a fixed locale to stop it.
Oct 19, 20264 min read
Developer Tools
Does deploying more often make software less secure?
Deployment frequency is not a security risk by itself. What matters is whether gates, rollback and small changes keep pace. Here is how to check.
Oct 19, 20264 min read
Developer Tools
Does Dependabot update Helm charts and GitHub Actions in shared repos?
Dependabot supports Helm for version updates only and GitHub Actions for version and security updates. What that means for shared CI and chart repositories.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.