Developer Tools
Pull request scan or nightly scan: do you need both?
Yes, for most teams. A pull request scan checks what changed, a scheduled scan checks what the world learned since. Here is how to split the work.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
What should a pull request template ask about new SDKs and APIs?
A short pull request prompt that catches new third-party SDKs and API calls at review time and links each to its inventory row.
Oct 19, 20264 min read
Developer Tools
How to pull release dates and deprecation flags from deps.dev
A short how-to for reading publish times, deprecation flags, advisories and Scorecard results for a package from the public deps.dev API with curl.
Oct 19, 20264 min read
Developer Tools
What does pubspec.lock record in a Dart or Flutter project?
pubspec.lock records the exact versions pub resolved from the ranges in pubspec.yaml. How caret ranges, overrides and content hashes affect what you scan.
Oct 19, 20264 min read
Developer Tools
How do you publish an SBOM next to your jar in a Maven repository?
The CycloneDX Maven plugin attaches the SBOM with a cyclonedx classifier so it deploys beside the jar. How it works and when to turn it off.
Oct 19, 20264 min read
Developer Tools
Public vs confidential OAuth client: how do you decide?
A client is confidential if it can keep a credential secret, public if not. Browser and mobile apps are public. How to register each and what changes.
Oct 19, 20264 min read
Developer Tools
What should you clean up in an AI-built prototype before it ships?
Before an AI-built prototype ships, remove unused dependencies, dead routes, debug flags, sample credentials and leftover files. Use this cleanup list.
Oct 19, 20264 min read
Developer Tools
How do you protect release branches so hotfixes still need review?
Use repository rulesets on release and hotfix branch name patterns to require review and checks, and limit who can bypass them, even in an emergency.
Oct 19, 20263 min read
Developer Tools
Prompt regression tests as a CI gate: what to include
A small set of fixed inputs run on every prompt change catches regressions before release. What belongs in it, how to grade it and what it cannot prove.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.