Developer Tools
APK signature schemes v2 and v3 and key rotation explained
APK Signature Scheme v2 signs the whole file from Android 7.0, and v3 adds key rotation from Android 9. What each means for app publishers and updates.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
How do you add API security tests to CI without slowing builds?
Split API checks by speed: fast checks on every pull request, heavier scans nightly on staging. What to gate on and how to use scanner exit codes.
Oct 18, 20263 min read
Developer Tools
What are the Deprecation and Sunset headers for retiring APIs?
The Deprecation header (RFC 9745) and Sunset header (RFC 8594) tell clients an API is on its way out. See formats, rules and a safe retirement plan.
Oct 18, 20263 min read
Developer Tools
Does a security tool have an API and webhooks? What to ask a vendor
An API decides whether a security tool fits your workflow. Ask about coverage, authentication, limits, webhooks, versioning and export formats.
Oct 18, 20263 min read
Developer Tools
Anti-rollback: security counter or version number?
Rollback protection stops an attacker installing an old signed image. MCUboot offers version checks and a hardware security counter. How they differ.
Oct 18, 20263 min read
Developer Tools
How reliable is Ansible check mode as a preview of changes?
Ansible check mode is a simulation. Modules that do not support it report nothing, and tasks that depend on earlier results may skip. What to rely on.
Oct 18, 20263 min read
Developer Tools
What are consumer ProGuard rules and why do libraries ship them?
Android libraries can ship consumer ProGuard rules that are appended to your app's shrinker config. Learn what that does and how to review the effect.
Oct 18, 20263 min read
Developer Tools
Does an Android dependency ship in every build variant?
By default, implementation and api dependencies apply to every Android build variant. Scope a library with variant configurations, then scan each variant.
Oct 18, 20263 min read
Developer Tools
Write an analytics tracking plan that avoids personal data
How to design analytics events with a written purpose per event, an allowlist of properties, and no emails or free text, so tracking stays minimal.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.