A new developer should leave week one with verified tools installed, access to the shared workspace, one project scanned, and a clear idea of who to ask when a finding looks serious. This checklist turns that into steps you can tick off in a day.
Day one: install and verify
- Download tools only from the official pages you have bookmarked.
- Verify each installer's SHA-256 hash against the published value. See the post on verifying a checksum.
- Note the version of each tool in the onboarding record.
For Safeguard Desktop 3.2.2, the download page lists builds for Windows 10 and 11, macOS 12 or later and 64-bit Linux, with checksums for each build. The Windows installer needs no administrator rights but triggers a SmartScreen warning because it is not yet code-signed, so brief new staff on that in advance.
Day one: access
- Create the new account through your identity provider, not a shared login.
- Grant the smallest set of projects needed.
- Confirm multi-factor authentication is on before first use.
Day two: scan something real
Pick a small, low risk repository. Run a scan, then read the results together with a teammate. Teach three things: what a finding is, how to find the fixed version, and how to tell whether the vulnerable code is used.
Ask the new developer to explain one finding back in their own words. That is a better test than a quiz.
Day three: the pull request path
Walk through your own pipeline gate. Show a pull request that was blocked and why, then one that passed. Use the pre pull request checklist as the working document.
Day four: where to ask
Write down three contacts: who owns dependency policy, who decides risk acceptance, and who to tell in an emergency. Put the emergency contact on a card, not buried in a wiki.
Day five: first small win
Assign a minor dependency update with a clear fix, so the developer completes the full loop of scan, change, review and merge. A first loop that works builds the habit.
What to avoid
Do not hand over a long document. People forget most of it. Pair one short checklist with a person who can answer questions.
Do not install every tool at once. Start with the ones used daily and add others as the need appears.
Do not let them skip verification because the tool looks official. Doing it once under supervision is what makes it a habit.
Where Safeguard fits
Safeguard offers Desktop, the CLI, IDE extensions and mobile apps, so a new developer can begin with one and add others later. The free scan at gold.safeguard.sh/scan is a gentle first exercise, since it needs no login.
Quick check
How much should a new developer install in week one?
Only the tools used daily. Add others as needs arise.
Why teach checksum verification during onboarding?
It is quick, and doing it once under supervision builds the habit.
Sources
Last reviewed: 19 October 2026.
