Developer Tools
What does NuGet warning NU1507 mean, and how do I fix it?
NU1507 warns that several package sources are configured while using central package management. Fix it with package source mapping or a single source.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Is npx safe? What it downloads and runs, and how to use it carefully
npx runs a local package if one exists, otherwise downloads and runs registry code after a prompt. See what the yes flag skips and how to cut the risk.
Oct 18, 20263 min read
Developer Tools
What does npm audit actually check, and what does it send?
npm audit sends your dependency list to the registry and reports known advisories. What it checks and sends, how exit codes work, and what audit fix does.
Oct 18, 20263 min read
Developer Tools
What does // indirect mean in go.mod?
An indirect comment in go.mod marks a module your code does not import directly. It is still in your build, so it still needs vulnerability scanning.
Oct 18, 20263 min read
Developer Tools
What does Electron's crash reporter send, and how do you keep it local?
Electron's crashReporter uploads minidumps by default once started. What the payload contains, the uploadToServer setting and a privacy checklist.
Oct 18, 20263 min read
Developer Tools
What does cosign verify actually check, and what does it skip?
Cosign verify checks a signature, a digest match and, with the right flags, a signer identity. What passes, what you must add, and the flags to avoid.
Oct 18, 20263 min read
Developer Tools
What does a version like 1.2.11#9 mean in vcpkg?
In vcpkg, 1.2.11#9 is upstream version 1.2.11 with port version 9. How the four version schemes sort, and why it matters when checking a fix.
Oct 18, 20263 min read
Developer Tools
What do NuGet warnings NU1901 to NU1904 mean?
NU1901 to NU1904 are NuGet Audit warnings for packages with known vulnerabilities, ranked low to critical. Here is each code, plus NU1900 and NU1905.
Oct 18, 20263 min read
Developer Tools
What counts as a breaking change in an automated fix PR?
A breaking change is any change that makes existing code stop working. Semver promises, what it misses, and how to check a fix PR for breakage.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.