Developer Tools
Why does an AI assistant get the pip install name wrong?
Assistants often copy the import name into a pip install line. Learn why the two names differ and how to confirm the right package before you install.
Oct 19, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Why does my AI assistant add a second library that does the same job?
Assistants often add a new package without noticing one you already use. Learn how duplicate libraries creep in and how to catch them in code review.
Oct 19, 20264 min read
Developer Tools
An AI agent regenerated the lockfile: what should you check?
If an AI agent deleted and rebuilt your lockfile to fix an error, every pinned version may have moved. Here is how to see what changed and what to keep.
Oct 19, 20264 min read
Developer Tools
How do you encrypt data with AES-256-GCM in Node.js?
A short, correct AES-256-GCM example for Node.js: random key, fresh 12 byte IV, auth tag handling, storage format and the mistakes that break it.
Oct 19, 20264 min read
Developer Tools
How do you add security measures to a DORA dashboard?
Add three or four security measures beside the five DORA metrics, per service, with the same time window. Which ones, how to define them, and what to skip.
Oct 19, 20264 min read
Developer Tools
How do you add Dependabot to every new service from a template?
Ship a dependabot.yml in your service template so every new repo gets update pull requests from day one. Steps, fields to set and mistakes to avoid.
Oct 19, 20264 min read
Developer Tools
How do you add a was-this-useful signal to security comments?
A one click useful or not useful signal on security comments gives you a real false positive rate by rule. Here is how to collect it and act on it.
Oct 19, 20263 min read
Developer Tools
How do you add a SECURITY.md to a research software repository?
Add a short SECURITY.md that says which versions are supported and how to report a vulnerability. A template, a checklist, and what to avoid promising.
Oct 19, 20264 min read
Developer Tools
Should you add a library or write the code yourself?
A short guide to choosing between a third-party library and your own code, based on size, risk domain, churn and how easily you could swap it later.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.