Developer Tools
Which Maven Enforcer rules help with dependency security?
Three Maven Enforcer rules, dependencyConvergence, requireUpperBoundDeps and bannedDependencies, can fail a build before risky dependency drift ships.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Why does Maven say Blocked mirror for repositories?
Maven 3.8.1 and later block plain HTTP repositories. The blocked mirror error means a POM points at http. Here is how to fix it without weakening security.
Oct 18, 20264 min read
Developer Tools
Manifest or lockfile: which gives a more accurate vulnerability scan?
A manifest declares ranges, a lockfile records what was installed. Scanning the wrong one gives guesses. Here is how to choose and how to verify.
Oct 18, 20263 min read
Developer Tools
How do you make developers use the internal registry?
Config files only guide developers. To enforce an internal registry, set defaults on machines, set them in CI, and block direct egress. Steps and gaps.
Oct 18, 20264 min read
Developer Tools
How do I make a .NET build fail on vulnerable NuGet packages?
Treat NuGet audit warnings NU1901 to NU1904 as errors, ideally in a dedicated audit pipeline, so new advisories do not block unrelated fixes.
Oct 18, 20264 min read
Developer Tools
Logical or physical backups for PostgreSQL: which should you use?
SQL dumps, file system copies and continuous archiving each protect different things. A comparison of speed, portability, restore scope and recovery point.
Oct 18, 20263 min read
Developer Tools
Should you log rate limit and throttling events? What to record
Yes, log rate limit hits as structured, deduplicated events with actor, route and limit. Avoid flooding your own logs by pairing summaries with counters.
Oct 18, 20264 min read
Developer Tools
Lockfile scan or built artifact scan: which counts for a release?
Scan both. The lockfile gives fast feedback, but the built artifact is what ships, so release evidence should rest on the artifact scan, not the lockfile.
Oct 18, 20263 min read
Developer Tools
How do you stop security scanners flooding pull requests?
Cap scanner comments with one summary, new findings only, reachability filters and severity thresholds, so developers read what the scanner says.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.