Developer Tools
How do you remove build paths from a Rust binary?
Use rustc remap-path-prefix to rewrite your build directory in output. Know the scope options and the linker paths it cannot change before relying on it.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Runtime version drift: pin Node and Python so environments agree
The same packages behave differently on different runtimes. Declare Node and Python versions in the repo and check them in every environment.
Oct 19, 20263 min read
Developer Tools
Do you need the full test suite for a patch version bump?
Patch bumps are meant to be safe, but not every one is. A simple rule for when a fast subset is enough and when the full suite must run before you merge.
Oct 19, 20264 min read
Developer Tools
How do you scan only the changed paths in a monorepo pull request?
Use path filters or a changed file list to scan only what a pull request touches, and keep a scheduled full scan so shared code is not missed.
Oct 19, 20264 min read
Developer Tools
Why run pip check after upgrading Airflow providers?
Airflow providers ship separately, and upgrades are not guaranteed to work with every core release. Run pip check as a cheap gate after each change.
Oct 19, 20263 min read
Developer Tools
Should you run OpenSSF Scorecard on your repos and share the score?
Scorecard grades repository practices from 0 to 10 per check. Run it to find gaps, but share the findings and fixes, not a single headline number.
Oct 19, 20264 min read
Developer Tools
How do you run notebooks in CI with nbconvert without opening a hole?
Executing notebooks in CI runs every cell as the job's account. A checklist for isolation, timeouts, credentials and which notebooks to run at all.
Oct 19, 20263 min read
Developer Tools
How do you run Google Tag Manager under a strict CSP?
Use a per-response nonce for the container snippet, add the needed Google hosts, avoid unsafe-eval with templates, and collect reports. Steps and caveats.
Oct 19, 20263 min read
Developer Tools
Rulesets or branch protection: which should guard a fix bot?
Both can force fix PRs through review and checks. Here is how GitHub rulesets and branch protection differ and which settings matter for a fix bot.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.