Developer Tools
hreflang for translated docs: rules and pitfalls
Tell Google which language version to show. Rules for return links, language and region codes, x-default, and mistakes that get hreflang ignored.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
How do you write your own CI security gate, and what will it cost to keep?
Writing a CI security gate is a few lines of script. Keeping it fair, fast and trusted takes more. Steps, exit codes, exceptions and the upkeep to expect.
Oct 18, 20263 min read
Developer Tools
How do I vendor Rust dependencies with cargo vendor?
Run cargo vendor, add the printed source replacement to .cargo/config.toml, and build offline. Steps, useful flags and what vendoring does not fix.
Oct 18, 20263 min read
Developer Tools
How do you update Go dependencies safely?
List available Go module updates, upgrade one module at a time with go get, tidy, review go.sum, test, and confirm the fix. A repeatable update routine.
Oct 18, 20263 min read
Developer Tools
How do you test that your release gate actually blocks?
Test the gate on a schedule with a planted known vulnerable component and confirm the release stops, the right rule fires and the event is logged.
Oct 18, 20263 min read
Developer Tools
How do you test that your app actually logs security events?
Write tests that trigger a login failure, a denial or a role change and assert the log event appears. Steps, a test matrix and failure cases to simulate.
Oct 18, 20264 min read
Developer Tools
How do I test policy enforcement that a report only scores on paper?
Policy and gate features are easy to claim and hard to judge from a chart. Run three pull request tests to see whether enforcement really blocks risk.
Oct 18, 20263 min read
Developer Tools
How do you stop an AI coding agent from reading your .env files?
Use deny rules for secret paths, a sandbox for OS-level enforcement and fewer long-lived keys on the laptop. Step by step, with the limits explained.
Oct 18, 20263 min read
Developer Tools
How do you sign release files with cosign sign-blob?
Sign tarballs, installers and other non-container files with cosign sign-blob and a bundle, then verify with identity checks. Steps, flags and pitfalls.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.