Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Use a Gradle dependency constraint to raise a transitive library to a fixed version without adding it as a direct dependency. Kotlin DSL example, limits.
compileOnly is not packaged in your build output, while runtimeOnly is. Learn what each Gradle configuration means for what actually reaches users.
In Gradle, api passes a dependency to consumers while implementation keeps it off their compile classpath. What that means for who inherits a library.
GPG signing uses a long-lived key you must protect. Sigstore keyless signing ties a short-lived certificate to a CI identity. How to choose for releases.
GOVCS limits which version control tools the go command runs to fetch modules. Learn the syntax, the default, and when to tighten it for safety.
GOTOOLCHAIN decides whether the go command may switch to a newer Go toolchain it downloads and verifies. See the values, the default, and how to pin CI.
google() serves AndroidX, Play services, Firebase and other Google libraries; mavenCentral() serves the wider open source set. Declare both and filter.
Go 1.24 added a tool directive to go.mod so linters and generators are versioned and checksummed with your code. Learn the commands and the tradeoffs.
Since Go 1.16, readonly is the default: the build fails if go.mod needs changes. Why that matters for CI, which settings to avoid, and what to add.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
