Developer Tools
How does a CLI pull a malicious plugin from users' machines?
Plan revocation before launch: a signed blocklist the CLI checks, a way to disable on next run, user notification and a record of who installed what.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Is a PlatformIO lib_deps entry pinned enough for an SBOM?
A PlatformIO lib_deps line can name a registry version, a Git tag or a branch archive. See which forms are reproducible and how to record them.
Oct 19, 20263 min read
Developer Tools
How do you plan dependency upgrades when test coverage is thin?
With thin tests, build a small safety net first: smoke tests on critical paths, staged rollout, fast rollback. Then upgrade in small steps, not one jump.
Oct 19, 20264 min read
Developer Tools
How do you plan a major framework upgrade on a product roadmap?
Plan a major framework upgrade as its own roadmap item: inventory usage, read the breaking changes, stage the work, and set a security driven deadline.
Oct 19, 20263 min read
Developer Tools
How do you find which C library version pkg-config gives you?
pkg-config and pkgconf report the installed version and flags of a C library. Learn the commands, the search path trap, and how to record the result.
Oct 19, 20263 min read
Developer Tools
pip or python -m pip: which pip are you actually running?
The pip command can belong to a different Python than the one you meant. Python -m pip ties the install to a named interpreter. Here is how to check.
Oct 19, 20263 min read
Developer Tools
What does pip's no-require-hashes option do, and should you use it?
Pip 26.2 added a flag that disables automatic hash enforcement. Learn the problem it solves, its risk, and a safer way to mix local and hashed installs.
Oct 19, 20264 min read
Developer Tools
pip install or uv pip sync: which removes extra packages?
uv pip install leaves packages that are not in your lockfile; uv pip sync makes the environment match exactly. Which to use after moving from pip to uv.
Oct 19, 20264 min read
Developer Tools
pip install with the user flag or a virtual environment: which to use?
The pip user option installs into your account's folder, not a project. A virtual environment is the safer default for most work. Here is the difference.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.