Developer Tools
Safeguard articles tagged "Developer Tools" — guides, analysis, and best practices for software supply chain and application security.
100 articles
Which registry does an image name without a host pull from?
A name with no registry host resolves to Docker Hub in Docker and Kubernetes by default. Podman can search several registries. Write the full host.
Which pytest plugins load automatically, and how do you stop that?
pytest loads plugins registered through entry points in installed packages unless PYTEST_DISABLE_PLUGIN_AUTOLOAD is set. How that affects CI trust.
Which pip index URL wins: command line, environment or config file?
pip merges a global, user and site config, then environment variables, then flags. How to find which index your CI really uses and stop surprises.
Why is pip using an index I did not set? Check config precedence
Pip merges config files, environment variables and flags in a set order. Learn the precedence, how to list what is active, and how to lock CI down.
Which npmrc files does npm read, and which one wins?
npm reads four npmrc files: project, user, global and built-in. How to see which one sets a value, and why a stray registry line can reroute installs.
Which npm packages work in the Vercel Edge runtime?
Vercel's Edge runtime accepts ES module packages that avoid native Node.js APIs, eval and the file system. A short test to run before adding a dependency.
Which Node.js version should your team run in October 2026?
Run an LTS release, never an end-of-life one. Here is how the Node.js release table reads today, what 30 months of support means and how to plan upgrades.
Which Maven dependency scopes end up in your SBOM by default?
The CycloneDX Maven plugin includes compile, provided, runtime and system scope by default and leaves out test. What each scope means for you.
How do you check which manifest files your scanner actually read?
If a scanner misses a package, it may never have opened the file that lists it. List your manifests, compare with the scan inputs, and close the gaps.
Which lockfile does each language use, and should you commit it?
Lockfile names and commit guidance for npm, Cargo, Composer, NuGet, Gradle, pip and Go, with a rule of thumb for applications versus libraries.
Which lockfile do I commit for each ecosystem?
A table of the file that pins exact dependency versions for npm, Cargo, Python, Go and Maven, and whether to commit it, drawn from each tool's own docs.
Which iframe sandbox tokens does a store widget need?
A sandboxed iframe starts with every restriction on. Learn which tokens a review, chat or payment widget needs and which combination undoes the sandbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.