Developer Tools
What do the TTL and Urgency headers do in web push?
TTL decides how long a push service holds your message, Urgency sets its priority. See the rules in RFC 8030 and how they affect stale alerts and battery.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Can the push service read your web push notifications?
Web push messages are encrypted so the push service cannot read them, but timing and size still leak. Here is what RFC 8291 protects and what it does not.
Oct 19, 20263 min read
Developer Tools
How do you get alerted when your open source scanner has a new release?
Set a custom GitHub watch on your scanner repository so releases and security alerts reach an owner. Steps, a routine and what to do on each alert.
Oct 19, 20263 min read
Developer Tools
How do I watch a GitHub repo for releases and security alerts only?
Use the Watch menu, choose Custom, and tick only the event types you need, such as releases and security alerts, to cut down on notification noise.
Oct 19, 20264 min read
Developer Tools
How do you warm CI dependency caches before a release day burst?
Warm caches and mirrors ahead of a release or freeze lift so a surge of builds does not hammer the registry. A step by step plan with a schedule.
Oct 19, 20264 min read
Developer Tools
What should an engineer see on a vulnerability finding?
Engineers fix findings faster when each one shows the package, fixed version, path, reachability and an owner. Here are the fields and why each matters.
Oct 19, 20263 min read
Developer Tools
Does VS Code ask you to trust a publisher before installing?
Since VS Code 1.97, installing from a third-party publisher shows a trust dialog. Command line installs do not get automatic publisher trust. What to know.
Oct 19, 20264 min read
Developer Tools
Why is the VS Code AllowedExtensions policy not applying?
A syntax error stops VS Code from applying the allowlist at all. Check the Window log, key format, wildcard use and version pins before blaming the tool.
Oct 19, 20263 min read
Developer Tools
Is it safe to expose the Vite dev server with host and allowedHosts?
Keep the Vite dev server on localhost. If you must expose it, use an explicit allowedHosts list, never true, and leave strict file serving switched on.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.