Developer Tools
Why does every service need one owner field that all teams trust?
An owner field per service lets alerts, exceptions and audit requests find the right person. How to keep one field accurate across three teams.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Do you need a separate Go SBOM for each build target?
Go build constraints such as GOOS, GOARCH and tags change which modules compile in. The CycloneDX gomod tool says to generate one SBOM per target.
Oct 19, 20264 min read
Developer Tools
How do GitHub environments protect client deployments and secrets?
GitHub environments gate deploys with reviewers, branch rules and scoped secrets. How agencies can use them so one client's production keys stay isolated.
Oct 19, 20264 min read
Developer Tools
Can one fix close many alerts? Group findings by root cause
Many alerts share one root cause, such as one parent package or one base image. Group findings by the change that closes them to shrink the list fast.
Oct 19, 20264 min read
Developer Tools
How do you train a new reviewer in secure code review in one week?
A five day plan to get a developer reviewing for security: method, checklists, shadowing, a supervised review and feedback, from public review guidance.
Oct 19, 20264 min read
Developer Tools
What do you check about old npm lockfiles before scanning a monorepo?
Old npm lockfiles may be stale, missing or mixed with other managers. Four checks to run before the first scan so your results reflect what actually ships.
Oct 19, 20264 min read
Developer Tools
OIDC trust policies after repository consolidation: what to change
Cloud trust rules for GitHub OIDC match the repo in the token subject. After a monorepo move they break, and loose fixes widen access. Fix them well.
Oct 19, 20263 min read
Developer Tools
What happens when a user clicks log out in an OIDC app?
Clearing your own session is not enough. OIDC RP-initiated logout sends the user to the provider with an id_token_hint and a registered return URL.
Oct 19, 20264 min read
Developer Tools
Tag or digest: what does an OCI registry guarantee on pull and delete?
A digest names fixed content, a tag is a pointer that can move. What the OCI distribution spec says on pulls, tag and manifest deletion, and mutability.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.