Developer Tools
In-depth guides and analysis on developer tools from the Safeguard engineering team.
100 articles
Where should you scan in a release pipeline: build, registry or deploy?
Scan at several points, each answering a different question: pull request for speed, build for the artifact, registry for drift, deploy for the record.
Where to keep code signing keys: hardware tokens or cloud signing
Public code signing keys must sit in hardware crypto modules since June 2023. Compare tokens, HSMs and cloud signing for a release pipeline.
Where should SCA findings appear: IDE, pull request, CLI or dashboard?
Compare the four places SCA results can reach developers, what each does well, and how to pick a mix that fits how your team actually works.
Where does PHI hide in a code repository?
Patient data leaks into repos through fixtures, logs, config and comments. Learn the common places, what counts as PHI, and how to scan for it.
Where do Gradle plugins come from, and how do I control the source?
Gradle plugins resolve from the public Gradle Plugin Portal by default. Use pluginManagement repositories in settings to choose sources and pin versions.
Where do DVC remote credentials go, and what stays out of Git?
DVC keeps shared remote settings in a committed config and sensitive ones in a Git-ignored local file. How the local flag works and a review checklist.
Where do devcontainer.json lifecycle commands run: host or container?
initializeCommand runs on the host, the rest run inside the container. Learn the order, what each can reach and why the first one deserves a close read.
Where does a repository's dependency graph go blind?
Dependency graphs read manifests and lockfiles, so they miss vendored code, unsupported ecosystems and runtime loads. Learn the gaps and how to cover them.
When does PostgreSQL 14 reach end of life, and how do you upgrade?
PostgreSQL 14 gets its final release on 12 November 2026. Here is the five year policy, which versions are next, and how to plan a major upgrade.
When does .NET 8 reach end of support, and what should you do?
.NET 8 and .NET 9 both reach end of support on 10 November 2026. See why they match, what .NET 10 offers, and a short upgrade plan to follow.
What should a dependency scan exclude in a monorepo?
Decide scan scope by what ships. Test fixtures, examples and build tooling often hold manifests that add noise, while vendored code belongs in scope.
What should you do when an automated fix PR fails CI?
A failing fix PR is a signal, not an annoyance. A triage flow to tell flaky tests from real breakage and decide to fix, adjust, defer or close.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.