developer-tooling
Safeguard articles tagged "developer-tooling" — guides, analysis, and best practices for software supply chain and application security.
7 articles
Eighteen Minutes: The Nx Console Supply Chain Compromise Timeline
A malicious Nx Console extension harvested developer credentials from disk and memory before being pulled from two marketplaces, in windows as short as 18 and as long as 36 minutes.
Cybersecurity SDK: Building Security Into Your Application from Code
A cybersecurity SDK gives developers ready-made libraries for the security work they would otherwise get wrong — crypto, auth, scanning, and secrets. Here is how to choose and use one well.
eslint-plugin-react-refresh: What It Does and Why It Matters
A guide to eslint-plugin-react-refresh: what the only-export-components rule enforces, how it relates to the react-refresh webpack plugin, and its security relevance.
How to Change Java Versions on a Mac: jenv, SDKMAN, and JAVA_HOME
Three reliable ways to change Java version on a Mac — plain JAVA_HOME switching, jenv shims, and SDKMAN — with per-project pinning so builds stop depending on whatever your shell happens to export.
How the Snyk Language Server powers IDE plugins across VS...
A technical look at how Snyk's Go-based Language Server uses LSP and a delegating scanner pattern to power VS Code, JetBrains, and Eclipse plugins from one binary.
lint-staged (npm): A Security Review and Safe Setup Guide
The lint-staged npm package runs linters and formatters only on your git-staged files, keeping commits clean and fast. Here is how to configure it safely and what its command-running design means for security.
VS Code marketplace incident postmortem: what 2023-2024 actually taught us
Between 2023 and 2024 the VS Code Marketplace saw a string of typosquat, hijack, and impersonation incidents that shaped Microsoft's eventual hardening response. This is a composite postmortem of what happened, what changed, and what is still broken in 2026.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.