engineering
Safeguard articles tagged "engineering" — guides, analysis, and best practices for software supply chain and application security.
7 articles
Git Ancestry Lies About Whether Work Shipped
A commit hash derives from its parents, so a rewrite gives identical changes new identities. is-ancestor answers graph position, not whether the change is present, and squash merges put most teams in this state permanently.
Never Investigate a Bug by Calling the API as a Real Customer
That read is very likely a write. Progress state, audit rows, quotas, notifications and billing all record the identity you sent, permanently, under a real person's name, and it contaminates the thing you were investigating.
The Shard Ceiling Turns Failed Writes Into Empty Reads
A search cluster at its shard limit stops creating indices. The read path cannot tell a missing index from no matching documents, so both return an empty list with a 200. Dashboards show zero and nothing pages.
A Container Stuck on health: starting Is Probably a Crash Loop
Each restart resets the health check, so a crash loop and a slow boot look identical in the status column. The one command that tells them apart, and the merge conflict class that produces the most convincing version.
Four Ways a Java Agent Instruments Nothing and Tells You It Worked
Class loader boundaries, a class literal that cannot resolve, advice read as a resource, and a re-entrancy guard that sticks. All four produce an agent that attaches cleanly and finds nothing.
A 200 Does Not Prove the Page Is Reading Your CMS
We moved a few hundred pages from committed files into a content API. Every page returned 200 throughout, including the four things we broke. What to assert instead of status.
The One Line of Ordinary Code That Kills a Taint Engine
param = decode(param) is as common as code gets. In a dataflow engine that resolves variables by looking backwards, it can recurse forever — and in Go the resulting stack overflow cannot be caught.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.