Developer Tools
What is a NuGet audit source and do I need one?
A NuGet audit source supplies the vulnerability list used by restore. You need one if nuget.org is not a package source. Here is how to set it up.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
What is a Maven SNAPSHOT version and why keep it out of production?
A SNAPSHOT marks work in progress, so the same version can change over time. Why that breaks repeatable builds and how to release a fixed version instead.
Oct 18, 20263 min read
Developer Tools
What is a lockfile maintenance PR and should you merge it?
A lockfile maintenance PR refreshes resolved versions inside your existing ranges without editing the manifest. Merge it like a batch of updates.
Oct 18, 20263 min read
Developer Tools
What is a golden pipeline and what belongs in it?
A golden pipeline is one centrally owned build and deploy template that every service calls. Here is what to put in it and what to leave to teams.
Oct 18, 20264 min read
Developer Tools
What is a dependency update bot and how does it work?
A dependency update bot checks manifests for newer versions and opens pull requests. Here is what it reads, what it changes and what it cannot judge.
Oct 18, 20264 min read
Developer Tools
What is a Dependabot alert, and why did you get one?
A Dependabot alert means a dependency in your repo matches a reviewed advisory. When alerts fire, what they show, their limits, and what to do first.
Oct 18, 20263 min read
Developer Tools
What is a container image layer, and why does a scanner care?
An image is a manifest, a config and stacked layers identified by digest. Layers explain scan results, image size, leaked files and where to fix a finding.
Oct 18, 20263 min read
Developer Tools
What is a certificate signing request (CSR) and what does it contain?
A CSR is the signed request you send a CA to get a certificate. It carries your public key and names, never the private key. How to make and check one.
Oct 18, 20263 min read
Developer Tools
What integrity checks does an MSIX package give you?
Every MSIX package must be signed and carries a block map of hashes for each 64 KB block. What that proves, what it does not and how to use it.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.