Developer Tools
How do you vet a new open source package in ten minutes?
A fast checklist for startups: check the name, maintainers, activity, install scripts, license and risky practices before adding a dependency.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
How do you verify a Node.js download in CI before installing it?
Verify the signed SHASUMS256 file with the release keyring, then check your tarball against it with shasum. Here are the steps and the traps to avoid.
Oct 19, 20264 min read
Developer Tools
How do you verify that a request really came from Slack?
Check the X-Slack-Signature header with your signing secret over the raw body, and reject requests older than five minutes to block replays.
Oct 19, 20264 min read
Developer Tools
How do you verify a reproducible build when the release is signed?
A signature is part of the file, so a rebuild cannot match it. Learn the three documented approaches, and how F-Droid copies APK signatures to compare.
Oct 19, 20264 min read
Developer Tools
What do Verdaccio uplink settings like maxage and max_fails do?
Verdaccio uplink keys control caching, metadata freshness, timeouts and failure windows. Defaults, what each does, and effects on outages and security.
Oct 19, 20263 min read
Developer Tools
Should a registry mirror's upstream token be inline or an env var?
Verdaccio can send a bearer token upstream from an env var or inline. Use env vars, scope the token, and keep it out of config held in version control.
Oct 19, 20263 min read
Developer Tools
How do Verdaccio package access rules work: all, authenticated, anonymous?
Verdaccio matches package patterns top to bottom, first match wins. What access, publish, proxy, all, authenticated and anonymous mean, and the pitfalls.
Oct 19, 20263 min read
Developer Tools
How do you validate Twilio webhook signatures the right way?
Validate X-Twilio-Signature with the exact public URL and every received parameter, serve HTTPS with a real certificate, and use the official library.
Oct 19, 20264 min read
Developer Tools
How do you validate environment variables at startup in Node?
Fail fast on bad config: a step by step way to validate environment variables in a Node and TypeScript service, with a no-dependency example.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.