Developer Tools
Go native fuzzing: write and run your first fuzz test
Go has fuzzing built into go test. Write a FuzzXxx function, add seeds, run with -fuzz, and keep failing inputs as regression tests. A short walkthrough.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
How do you find deprecated modules in a Go project?
Go marks a deprecated module with a comment in go.mod, and go list shows it. Here is the command, what the marker covers, and how to act on it.
Oct 18, 20263 min read
Developer Tools
Does go mod vendor let you build when the proxy is down?
Vendoring copies dependencies into your repo so Go builds do not touch the network. How it works, when Go uses it automatically, and the upkeep it adds.
Oct 18, 20263 min read
Developer Tools
go.mod go line vs toolchain line: what does GOTOOLCHAIN do?
The go line sets a module's minimum Go version. The toolchain line suggests a toolchain, and GOTOOLCHAIN decides whether Go may download one.
Oct 18, 20263 min read
Developer Tools
What is the difference between the go line and toolchain line in go.mod?
The go line sets the minimum Go version a module needs. The toolchain line only suggests which toolchain to run. How both behave since Go 1.21.
Oct 18, 20263 min read
Developer Tools
Exclude, replace or upgrade: how to fix a vulnerable Go transitive module
To fix a vulnerable transitive Go module, require the fixed version directly. exclude only blocks a version, and replace skips authentication.
Oct 18, 20263 min read
Developer Tools
How do you know if a Go module is deprecated before you use it?
Go modules mark themselves deprecated with a comment in go.mod. Check with go list -m -u and read the message before adding or keeping a dependency.
Oct 18, 20263 min read
Developer Tools
How do you give developers self-service security scans?
Self service scanning means developers can run the same checks as the pipeline locally and in the IDE. Options, trade offs and a rollout plan.
Oct 18, 20263 min read
Developer Tools
Why does GitLab run two pipelines, or none, on a merge request?
Branch and merge request pipelines can both start, or neither. Use workflow rules and CI_OPEN_MERGE_REQUESTS so security jobs run once and never skip.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.