A small team can reach a sensible baseline in an afternoon: commit lockfiles, run one scanner on pull requests, set a weekly slot for updates, turn on branch protection, and write a one page rule for what blocks a merge. Skip the rest until you outgrow this.
The afternoon list
1. Commit lockfiles and install from them in CI. About twenty minutes per repository.
2. Add one scanner on pull requests. Pick one, not three. Start in inform mode.
3. Protect the default branch. Require review and passing checks. Without this the scanner is advice.
4. Choose an update slot. An hour each week to merge dependency updates. Put it in the calendar with an owner.
5. Enable secret scanning on the repository host, if available, and rotate anything found.
6. Write the rule. One paragraph: what blocks a merge, who can grant an exception, and how long it lasts.
What to postpone
- Several overlapping tools
- Custom dashboards
- Deep programmes for risk scoring
- Full compliance mapping, unless a customer asks for it
Each can come later when a real pain appears.
Signs you have outgrown it
- Findings pile up faster than you close them
- Customers ask for reports or an SBOM
- You manage many repositories and cannot see them together
- Developers ignore scanner comments
At that point look at prioritisation, reporting and policy features, and evaluate with your own code as in a trial.
Keep it honest
A baseline lowers common risk. It does not stop a determined attacker or a flaw in your own code. Name those gaps so they do not go unremarked.
Keeping it alive
Baselines decay. Put a quarterly fifteen minute check in the calendar: are lockfiles still committed, is the scanner still running, are exceptions still valid, did the update slot happen. Small teams lose security habits to busy weeks, not to bad intent, so a light recurring check beats a larger one-off effort.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at what the developer sees when a check fails, and decide whether that message would be clear to your team.
Where Safeguard fits
Safeguard offers dependency scanning with policies and gates. The free scan is a no setup way to take step two.
Quick check
Do I need a security person to do this?
No. A developer with an afternoon can set up the baseline.
Last reviewed: 19 October 2026.
