Developer Tools
How do you generate an SBOM for a Python project?
Python SBOM options: scan the installed environment, a Poetry or Pipenv lockfile, requirements.txt, or export from uv. What each covers and misses.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
How do you generate an SBOM for a Go project?
Generate a CycloneDX SBOM for a Go application with cyclonedx-gomod: pick app, mod or bin mode, set the output version, and avoid the common gaps.
Oct 18, 20263 min read
Developer Tools
How do you generate an SBOM for a .NET project?
Use the CycloneDX .NET global tool on a solution or project file, choose JSON and a spec version, and exclude test projects and dev only packages.
Oct 18, 20263 min read
Developer Tools
How do I fix a vulnerable transitive dependency in npm, pip or Maven?
When the vulnerable package is not yours, upgrade the parent first. If it has not moved, force the version with each tool's own override mechanism.
Oct 18, 20263 min read
Developer Tools
How do you find which package owns a vulnerable file on Linux?
Use dpkg -S on Debian and Ubuntu, or rpm -qf on RPM systems, to map a file to its package, then check that package's advisory and fixed version.
Oct 18, 20264 min read
Developer Tools
How to evaluate policy and gate features in a security tool
Policy engines decide what ships. Check rule clarity, report mode testing, exception handling, audit logs and failure behaviour before enforcing.
Oct 18, 20263 min read
Developer Tools
How do I evaluate autonomous remediation beyond analyst criteria?
Automated fix pull requests are new enough that reports may treat them lightly. Here is a control-first way to evaluate them in a proof of concept.
Oct 18, 20263 min read
Developer Tools
How do you enforce team security settings for a coding agent?
Enforce agent rules with organization-managed settings that outrank user and project files, share approved permissions in git, and audit changes.
Oct 18, 20263 min read
Developer Tools
How to enable GPUs in Docker with the NVIDIA toolkit, safely
Install steps for the NVIDIA Container Toolkit with Docker, what each command changes, and review points that keep a GPU host from becoming a soft target.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.