Developer Tools
Do you need TUF, or is a signed binary enough for CLI updates?
A signature proves who built a file. TUF also protects against stale, replayed and key-compromise cases. A decision guide for small CLI teams.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Do you need Gradle lockfiles before onboarding a dependency scanner?
You can scan without Gradle lockfiles, but results get exact once they exist. When to generate them, where they live and how to review the first commit.
Oct 19, 20263 min read
Developer Tools
Do you need a private VS Code extension marketplace?
A private marketplace self-hosts internal extensions and rehosts reviewed public ones, even air-gapped. When it beats an allowlist, and when it does not.
Oct 19, 20264 min read
Developer Tools
Do dependency update bots work with merge queues and merge trains?
Some update bots hand automerged pull requests to a merge queue or train. Learn what to enable, what CI must test, and the traps in branch automerge.
Oct 19, 20264 min read
Developer Tools
Do update bot pull requests get access to your CI secrets?
Pull requests from an update bot may run CI with a read-only token and no repository secrets. Here is why that breaks builds and how to fix it safely.
Oct 19, 20264 min read
Developer Tools
Do security fix pull requests count against your open PR limit?
In two widely used update bots, security fix pull requests follow separate rules from the open PR cap. Check yours before a low limit hides a fix.
Oct 19, 20264 min read
Developer Tools
Do a departed developer's signed commits stay verified on GitHub?
Yes. GitHub records verification at push time and does not re-check it, so rotating keys or removing a member leaves old badges as they were.
Oct 19, 20264 min read
Developer Tools
Do pull request dependency scans cover transitive dependencies?
They can, but only if the scan reads a lock file. Without one, a pull request check sees your direct dependencies and misses most of the tree.
Oct 19, 20264 min read
Developer Tools
Do minified JavaScript bundles still need license notices?
Minifying does not remove a license's notice conditions. If the bundle is distributed, MIT, BSD and Apache notices still need to reach recipients.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.