Developer Tools
Reproduce a KEV, EPSS and OSV analysis yourself with curl and Python
How to download the CISA KEV feed, EPSS scores and OSV ecosystem dumps, count what you need, and record the method so a reader can repeat it.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Reproduce a KEV analysis yourself in 30 lines of Python
A short script that downloads the CISA KEV feed and counts additions, CVE age and top vendors, so you can check any claim about the catalog yourself.
Oct 18, 20264 min read
Developer Tools
Reproduce an OSV ecosystem analysis yourself in 40 lines
Download one OSV ecosystem export and count malicious records, missing CVE aliases and advisories without a fixed version, with a short Python script.
Oct 18, 20264 min read
Developer Tools
How do you report a scanner false positive so it actually gets fixed?
Report one rule per issue, include a minimal reproducible example, the tool version and expected result, and remove sensitive data. A checklist.
Oct 18, 20263 min read
Developer Tools
Why run the same security scan three times in an evaluation?
A tool that gives different results on identical input is hard to trust in a pipeline. Run each scan three times, diff the output and record the variation.
Oct 18, 20263 min read
Developer Tools
Where does remediation time go from finding to deploy?
Split remediation time into stages: triage, assignment, fix, review, merge and deploy. The slowest stage is usually not the fix itself, so measure each one.
Oct 18, 20263 min read
Developer Tools
How do you load a renewed TLS certificate in nginx without downtime?
Reload, do not restart. A HUP signal makes nginx check config, start new workers and drain old ones, so a renewed certificate loads cleanly.
Oct 18, 20263 min read
Developer Tools
Regional stack patterns for data residency: which one to pick
Four architecture patterns for keeping customer data in a region, from region pinned storage to fully separate stacks, and when each one fits.
Oct 18, 20263 min read
Developer Tools
Redirects and status codes for moved or deleted docs pages
Use 301 for permanent moves, 404 or 410 for pages that are gone, and avoid soft 404s. How Google treats each status code when you reorganize docs.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.