Developer Tools
What does conan audit check, and how do you run it?
conan audit scan checks recipes and their transitive dependencies for known vulnerabilities. What it covers, how the threshold works and its limits.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Composer platform config vs platform-check: what is the difference?
The platform setting fakes PHP and extension versions during resolution. platform-check verifies the real runtime. Why you want both, and a deploy test.
Oct 18, 20263 min read
Developer Tools
What do Composer minimum-stability and prefer-stable do?
minimum-stability sets the least stable release Composer may pick, default stable. prefer-stable favours stable ones. How to keep dev branches out.
Oct 18, 20263 min read
Developer Tools
What does the Composer lock file out of date warning mean?
The warning means composer.json changed and composer.lock did not. Run composer validate, then update the lock file on purpose and commit both files.
Oct 18, 20263 min read
Developer Tools
Composer install vs update: which should CI and production run?
CI and production should run composer install, which follows composer.lock. Run composer update on purpose, in a reviewed change. Reasons and flags.
Oct 18, 20263 min read
Developer Tools
composer install or composer update in production: which is safe?
Use composer install with a committed lock file in production. Update resolves new versions and rewrites the lock. What each does and why it matters.
Oct 18, 20263 min read
Developer Tools
Caret or tilde in composer.json: which version constraint is safer?
Caret allows non breaking updates up to the next major. Tilde is tighter on the last digit you write. What each allows, and why open ranges are risky.
Oct 18, 20263 min read
Developer Tools
What does Composer autoloading load, and what is classmap-authoritative?
Composer autoloading maps classes to files with psr-4, classmap and files rules. See which run code on every request and what classmap-authoritative does.
Oct 18, 20263 min read
Developer Tools
How do I run composer audit in CI, and what do its options do?
composer audit checks advisories and exits 1 on findings. Which options matter in CI: the locked flag, no-dev, abandoned handling and severity filters.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.