Developer Tools
In-depth guides and analysis on developer tools from the Safeguard engineering team.
100 articles
How long does a Zephyr LTS release get security fixes?
Zephyr says an LTS release is maintained for about five years: two years of general and security fixes, then security and stability only. Planning notes.
ZAP baseline scan vs full scan vs API scan: which should I run?
ZAP ships three Docker scan scripts. Baseline is passive and fast, full scan attacks, API scan imports a definition. Here is how to pick one for each job.
What is the ZAP Automation Framework, and how do I run a YAML plan?
The ZAP Automation Framework runs scans from a YAML plan with an env section and jobs like spider, activeScan and report, started with the autorun option.
What does ZAP's API scan test, and what does it skip?
ZAP's API scan imports an API definition and runs an active scan tuned for APIs. See supported formats, safe mode, exit codes and what it cannot cover.
Yocto SBOM with create-spdx: what you get and how to tune it
The Yocto Project generates SPDX SBOMs by default through the create-spdx class. Where the file lands, which variables matter, and what to check.
How do I fix a vulnerable transitive dependency in Yarn with resolutions?
Yarn's resolutions field forces one version of a nested package. See the syntax, the root-only rule, and a safe way to apply and remove a pin.
What do yarn npm audit and pnpm audit check by default?
Yarn audits direct dependencies unless you add the recursive option, and pnpm audit has its own scope flags. Check defaults before trusting a clean run.
Does modern Yarn run postinstall scripts? Defaults and hardened mode
Modern Yarn does not run third-party postinstall scripts by default. See how enableScripts, dependenciesMeta and hardened mode work, and what to review.
Should you yank or delete a bad release?
Yanking steers new installs away from a faulty release while keeping it available to people who pinned it. Deleting can break them. How to choose.
wsl.conf and .wslconfig settings that change WSL security
Drive automounting, Windows interop, PATH sharing and networking mode all change what WSL exposes. Here are the settings and defaults to review.
Write your first libFuzzer harness for a C parser
A libFuzzer harness is one function that takes bytes and calls your code. Here is a minimal C example, the build flags, and what the first run looks like.
How do you write an OpenAPI spec that helps security testing?
Declare security schemes, constrain inputs, list every operation and define errors. A better OpenAPI file gives scanners and reviewers more to work with.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.