Developer Tools
Can an SBOM generator run offline in an air-gapped build?
Yes, if it reads local files only. Here is how to test an SBOM tool offline, what degrades without a network, and what to ask before you buy.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Can an Android app download and run code after install on Google Play?
Google Play policy restricts self-updating and downloading executable code outside Play. What is excepted and what it means for plugin designs.
Oct 19, 20264 min read
Developer Tools
Can a security fix be a breaking change under semantic versioning?
Yes. If closing a hole changes the public API, semver requires a major bump. How to ship it, warn customers, and still patch the old line. Steps and table.
Oct 19, 20264 min read
Developer Tools
Can a Dev Container Feature change your container's security settings?
Yes. A Feature runs an install script as root and can declare privileged mode, capabilities, security options, mounts and an entrypoint. Check first.
Oct 19, 20264 min read
Developer Tools
Can a CVE record name the vulnerable function or file?
Yes. The CVE record format has optional fields for affected modules, files and routines. See what they hold, how often to expect them, and how tools use them.
Oct 19, 20264 min read
Developer Tools
Can a CVE record carry a purl (Package URL) now? CVE format 5.2
CVE Record Format 5.2.0 added support for Package URL identifiers in affected items. See what changed, what it helps with, and what still needs care.
Oct 19, 20263 min read
Developer Tools
bun.lock or bun.lockb: which Bun lockfile should you commit?
Bun v1.2 made the text based bun.lock the default. Here is which file to commit, how to migrate from bun.lockb, and what that means for scanning.
Oct 19, 20263 min read
Developer Tools
How do you bulk update WordPress plugins with WP-CLI safely?
Use the dry run, patch only and minor only options in WP-CLI to update client plugins in controlled steps, with exclusions for the plugins that need care.
Oct 19, 20263 min read
Developer Tools
Should a startup build or buy its first supply chain security tooling?
A decision guide for a small team choosing between free scripts, platform features and a dedicated product for its first supply chain security tooling.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.