Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Local runs touch your uncommitted work, worktree runs stay separate. Compare local, worktree and cloud runs for scheduled coding tasks and the trade offs.
Worked package URL examples for pypi, gem and golang, including the platform qualifier and the subpath. Steps to check a purl before it goes in an SBOM.
How to make sure no bot or automated fix merges without a person: required reviews, status checks, code owners, and settings that stop bypassing.
With Yarn PnP there is no node_modules folder, so folder based scanners can report nothing. Check that your SBOM tool reads yarn.lock and test the result.
Retry AI API rate limit errors with the retry-after value or exponential backoff and jitter, cap attempts, and never retry quota errors. Steps inside.
Follow advisories for your own stack, not the whole internet: GitHub watch settings, advisory database searches and registry feeds, with a checklist.
A plain git clone leaves submodule folders empty, so an SBOM tool can miss them. How to check out submodules first and record them as components.
Allow unapproved commands only for a short read-only list inside a sandbox. Everything that installs, deletes, or reaches the network should need a person.
A pull request is a proposed code change that people and tools check before it is accepted. For AI-written code it is where review and gates belong.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
