Developer Tools
Safeguard articles tagged "Developer Tools" — guides, analysis, and best practices for software supply chain and application security.
100 articles
Why should agencies commit lockfiles and use npm ci on client builds?
Committed lockfiles and npm ci give client builds repeatable installs and fail loudly on drift. Here is how to set it up and what it does not cover.
Does a skipped required status check block a GitHub merge?
GitHub accepts successful, skipped and neutral required checks. A check that never reports stays pending and can block. How to find and fix the stuck ones.
Why is a code scanning alert missing from my pull request?
Code scanning shows a result only with a usable location, and in a pull request only if its lines are in the diff. A checklist for missing SARIF alerts.
Why did my automation's pull request not trigger CI checks?
GitHub does not start most workflow runs from GITHUB_TOKEN events, to prevent loops. Why your automation's pull request has no checks and safe fixes.
Who should review a pull request an AI agent wrote?
A human who did not launch the agent should approve its pull request, with code owners on sensitive paths and fresh approval after any new push.
Who should own third-party SDK governance in a mobile company?
Mobile SDK governance works best with one accountable owner and clear helpers. A simple RACI for engineering, security, privacy, product and release managers.
Who should own custom static analysis rules in an engineering team?
Give every custom rule a named owner, a repository, a review process and a review date. A simple ownership model for small and mid size teams.
Who should a security comment notify: author, reviewer or team?
Notify the author first, the code owner when the finding touches their files, and the security team only for the rare critical case. A routing guide.
Who should review dependency updates in a shared design system repo?
Route runtime dependency changes to component owners, tooling bumps to a platform reviewer, and lockfile only changes to anyone on the team. A review map.
Who gets Dependabot alerts by default, and how do you widen it?
GitHub notifies people with write, maintain or admin access to the repository. Why that can miss security owners, and how to route alerts well.
Who patches a self-hosted CI runner: you or the platform?
GitHub updates the self-hosted runner application, but you own the OS and tools. Compare hosted, long-lived and just-in-time runner patching duties.
Who should own the central version list in a monorepo or parent build?
Governance for a central dependency version list in a monorepo or parent POM: ownership, review rules, change cadence, and how to handle team requests.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.