Developer Tools
What should you check before adding a new dependency?
Ten quick questions to ask before adding a package: purpose, publisher, install scripts, age, sources and fallback. Five minutes now can avoid weeks later.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
What tag naming scheme makes image retention rules easy to write?
Retention rules match tags, so design tags for them: a class prefix, a version, and a build id. A scheme that works with ECR, Harbor and Artifact Registry.
Oct 19, 20263 min read
Developer Tools
How do you run two scanners in parallel when switching tools?
Switching dependency scanners without losing coverage takes a parallel period: align inputs, compare a sample, restate your baseline, then cut over.
Oct 19, 20264 min read
Developer Tools
Why did a suppressed finding come back under a different ID?
A suppressed finding returns when reported under another ID for the same flaw. How aliases work and how to key suppressions so they keep matching.
Oct 19, 20263 min read
Developer Tools
What fields should a machine readable suppression record have?
A suppression record needs advisory ID, scope, reason, evidence, owner, approver and dates. Field list, a YAML example and a CI check for bad entries.
Oct 19, 20263 min read
Developer Tools
When should an IoT fleet update halt itself? Success and error thresholds
Set two numbers per rollout group: a success level that unlocks the next group and an error level that stops the whole rollout. How to pick them.
Oct 19, 20263 min read
Developer Tools
How do you check student projects for vulnerable dependencies?
A low-effort checklist for instructors and TAs to check student and capstone projects for vulnerable dependencies without turning grading into an audit.
Oct 19, 20264 min read
Developer Tools
How do you store an Apple signing certificate in CI without leaking it?
Keep the p12 and profile as encrypted CI secrets, use a temporary keychain on the runner, limit which jobs read them, and clean up self-hosted runners.
Oct 19, 20264 min read
Developer Tools
How do you store a certificate or key file as a GitHub Actions secret?
Small files go in as base64 secrets. Over 48 KB, GitHub suggests encrypting the file and storing the passphrase. Masking caveats and safer choices.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.