Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
web_accessible_resources lets sites and other extensions load your files. The default, what wildcards expose and how to keep the list small and exact.
What VS Code Workspace Trust does, what Restricted Mode turns off, and which settings control it, so you can open unfamiliar code without running it.
A repository can recommend extensions through .vscode/extensions.json. Learn how the prompt works, how to use it safely for your team, and what to check.
VS Code profiles bundle settings, extensions and MCP servers per project. Use them to limit which extensions can run next to sensitive code.
How to build an extension allowlist in VS Code with extensions.allowed: by publisher, by extension and by version, plus the AllowedExtensions policy.
VS Code updates extensions automatically, with a default 12 hour delay. Learn the settings to slow it down, switch it off, or pin a version you reviewed.
VS Code can run a task as soon as a folder opens. Here is how runOn folderOpen works, what task.allowAutomaticTasks does, and how to keep it off.
Payment and store webhooks can be forged unless you verify them. Check an HMAC signature, compare in constant time, reject replays and act idempotently.
A payment webhook endpoint is a public door that moves money state. How to verify the sender, reject replays and avoid acting twice on the same event.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
