Developer Tools
How do you make a TypeScript build fail on type errors?
TypeScript emits JavaScript even when types fail unless you act. How noEmitOnError and a separate noEmit check in CI keep type errors out of releases.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Trunk-based development and security: what to check on every merge
With short-lived branches and daily merges, security checks have to be fast and automatic. What to run on each merge to trunk, and what to leave for later.
Oct 19, 20264 min read
Developer Tools
How do you translate path based ignore rules between scanners?
Path and glob ignore rules rarely behave the same across scanners. Inventory them, test each one on a known tree, and watch for rules that hide too much.
Oct 19, 20264 min read
Developer Tools
Tool error or real finding? Reason codes for security build metrics
How to tell a scanner failure from a real finding in CI metrics: a small set of reason codes, where to record them and how to read the results.
Oct 19, 20263 min read
Developer Tools
Do timezone and locale settings change your build output?
Yes. A timezone, locale or default character set on the build machine can change dates, sort order and text encoding in output. Set TZ and LC_ALL in CI.
Oct 19, 20264 min read
Developer Tools
How should security automation jobs handle timeouts and failures?
Set timeout-minutes, decide which steps may fail without failing the job, and alert on failure so silence is never read as a clean scan. A policy table.
Oct 19, 20264 min read
Developer Tools
Should you run a timeboxed spike before a major upgrade?
Yes for most major upgrades. A two to three day spike turns a guess into an estimate. Here is what to test, what to record, and when to stop.
Oct 19, 20263 min read
Developer Tools
What is time to first security feedback and how do you measure it?
Time to first security feedback is the wait between a push and the first security result a developer sees. How to define it, measure it and shorten it.
Oct 19, 20263 min read
Developer Tools
How do you run a two-hour spike to evaluate a new library?
A two-hour plan to evaluate a new library: define the job, run it against real inputs, check license and security signals, and decide with evidence.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.