Developer Tools
In-depth guides and analysis on developer tools from the Safeguard engineering team.
100 articles
How do you write a custom secret detection rule for an internal token?
Detect your own token format with a prefix, fixed length and checksum rule, test it against real and fake samples, and measure false positives.
Workers nodejs_compat and polyfills: what should reviewers know?
The nodejs_compat flag lets many npm packages run on Workers, with some APIs polyfilled or stubbed. Why that affects dependency review and testing.
Why does a stdio MCP server skip OAuth and use environment credentials?
The MCP spec says stdio servers should not follow its OAuth flow and should read credentials from the environment. What that means for storing secrets.
Why does Spring Security logout only accept POST requests?
With CSRF protection on, Spring Security's logout only handles POST so a forged link cannot sign users out. Here are the safe ways to build a logout button.
Can you fulfil orders from the thank you page? Why webhooks win
Fulfilling from the checkout return page misses paid orders and can double ship. Fulfil from a verified server event and make the step safe to repeat.
Why is this dependency on my Java classpath? Maven and Gradle commands
Use mvn dependency:tree and Gradle's dependencies and dependencyInsight tasks to find which library pulled in a dependency and why that version won.
Why is my desired PyPI project name not available?
PyPI can reject a free looking name for four reasons: stdlib clash, confusable name, prohibited name, or an empty registration. How to check before you choose.
Why does pip say externally-managed-environment, and what to do?
The externally-managed-environment error means your system Python is owned by the OS. Learn why it appears and the safe fix: a virtual environment or pipx.
Why does NuGet pick the lowest package version, and is it safe?
NuGet resolves to the lowest version that satisfies every constraint. That keeps builds predictable, but it can leave a vulnerable version in place.
Why does my Android app request permissions I never added?
Library manifests merge into yours at build time, so an SDK can add permissions. How to see the merged manifest and remove what you do not need.
Why does my container ignore docker stop? Exec form and signals
A shell form CMD makes a shell PID 1, so your app may never see SIGTERM. Use exec form or the exec builtin so containers shut down cleanly and on time.
Why do some Electron APIs fail or misbehave in unsigned builds?
safeStorage, autoUpdater, login item settings and the cookie encryption fuse depend on code signing in Electron. What breaks, why and how to test properly.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.