Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
pytest loads plugins registered through entry points in installed packages unless PYTEST_DISABLE_PLUGIN_AUTOLOAD is set. How that affects CI trust.
pip merges a global, user and site config, then environment variables, then flags. How to find which index your CI really uses and stop surprises.
Pip merges config files, environment variables and flags in a set order. Learn the precedence, how to list what is active, and how to lock CI down.
npm reads four npmrc files: project, user, global and built-in. How to see which one sets a value, and why a stray registry line can reroute installs.
Vercel's Edge runtime accepts ES module packages that avoid native Node.js APIs, eval and the file system. A short test to run before adding a dependency.
Run an LTS release, never an end-of-life one. Here is how the Node.js release table reads today, what 30 months of support means and how to plan upgrades.
The CycloneDX Maven plugin includes compile, provided, runtime and system scope by default and leaves out test. What each scope means for you.
If a scanner misses a package, it may never have opened the file that lists it. List your manifests, compare with the scan inputs, and close the gaps.
Lockfile names and commit guidance for npm, Cargo, Composer, NuGet, Gradle, pip and Go, with a rule of thumb for applications versus libraries.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
