Developer Tools
Safeguard articles tagged "Developer Tools" — guides, analysis, and best practices for software supply chain and application security.
100 articles
Why does a scoped npm package need the public access option?
Scoped npm packages publish as private by default, so a first public release needs the public access option. Steps, a user scope example and safety tips.
Why does python setup.py install undermine pip hash checking?
Calling setup.py install or develop can download unchecked dependencies and bypass your hashes. Use pip with no-deps instead. Here is the reasoning.
Why is process.env typed string or undefined, and what to do?
process.env values are strings and may be missing. How TypeScript types them, the 'undefined' string trap, and a safe way to read config in Node.
Why does pip show a hash mismatch after you change install options?
A requirements file that worked can fail when you add a binary or source option, because the other archive has a different hash. Here is how to fix it.
Why OS patching and dependency patching need different tools
OS patching works on hosts and repositories. Dependency patching works on manifests, lockfiles and builds. Compare the two and pick tooling for each.
Why did my vulnerability alert not get a fix pull request?
An alert with no automatic fix PR usually means no patched version exists or the fix needs a parent upgrade. Here is how to tell which and what to do next.
Why should native apps use the system browser for OAuth sign in?
RFC 8252 says native apps should only use external user agents for OAuth. Embedded web views let the app read passwords and cookies. Here is the reasoning.
Why does Maven block HTTP repositories, and how do you fix it?
Since Maven 3.8.1, external HTTP repositories are blocked by default to stop man in the middle attacks. Here is why, and the right way to clear the error.
Should you use each language's audit command or one scanner?
Native audit commands differ in data source, scope and noise. Use them for fast feedback, then add one shared view so findings compare fairly.
Why is bot automerge so slow, merging one pull request at a time?
Automerge in update tools often lands one pull request per run, and needs fresh branches and passing checks. Here is why, and how a merge queue helps.
Why is this package in my build? Trace it from your SBOM
Found an unexpected package in your SBOM? Trace the chain that brought it in, using the SBOM graph plus npm explain or the Maven dependency tree.
Why is my build failing on a vulnerability I did not add?
A build can fail on a vulnerability you never touched because advisories change after merge. Here is how to read the failure and fix the gate.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.