Developer Tools
Where do security checks belong in build, release and run?
Twelve-factor splits delivery into build, release and run. Here is which security checks fit each stage and why the run stage should stay simple.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Where should local Postgres passwords go? The pgpass file and its rules
A .pgpass file lets libpq clients connect without typing a password, but on Unix it is ignored unless permissions block group and world access.
Oct 19, 20264 min read
Developer Tools
Where do build attestations live for a container image in a registry?
BuildKit stores SBOM and provenance attestations as manifests in the image index, in in-toto JSON, so you can inspect them without pulling the image.
Oct 19, 20263 min read
Developer Tools
Where do Claude scheduled tasks run: Cowork, Code, Desktop or cloud?
A map of the four places Anthropic's Claude products run scheduled work (Cowork, routines, Desktop, loops), what each can reach and when to use it.
Oct 19, 20266 min read
Developer Tools
Merging two internal teams or repos: a dependency policy checklist
When two internal teams combine or repos move into a monorepo, check dependency rules first: ownership, versions, scanners, and approval paths. A checklist.
Oct 19, 20264 min read
Developer Tools
When should you run a security scan from the CLI instead of CI?
Use the CLI for local checks, investigations, and custom pipelines. Use CI for anything that must be enforced on every change with the same settings.
Oct 19, 20263 min read
Developer Tools
When should you retire your fork and go back to upstream?
Retire a fork when upstream has your fix, your patch list is empty or tiny, or the sync cost exceeds the value. Set exit criteria on the day you fork.
Oct 19, 20264 min read
Developer Tools
When should you retire or rewrite a custom static analysis rule?
Retire a rule when the risky API is gone, a better check exists, or precision stays low. Rewrite when the idea is right but the matching is wrong.
Oct 19, 20264 min read
Developer Tools
When should you disable a failing webhook endpoint?
Stop sending to an endpoint that returns 410 Gone or fails for a long stretch. Here is a retry and disable policy that protects you and your customers.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.