Developer Tools
Should you write your own dependency scanner?
What building a dependency scanner in house involves: parsers, advisory data, matching, upkeep and triage, and when a small script is enough for you.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Should I use mavenLocal() or flatDir in a Gradle build?
Avoid mavenLocal and flatDir in shared or release builds. Gradle bypasses its cache for local repositories and says they make reproducible builds harder.
Oct 18, 20263 min read
Developer Tools
Should you sign your Sparkle appcast feed as well as the archives?
Signing update archives is the baseline. Sparkle can also require a signed feed and release notes. Here is what that adds, what it needs and what to watch.
Oct 18, 20263 min read
Developer Tools
Should you pin apt package versions in a Dockerfile?
Pinning makes builds repeatable but can freeze in a vulnerable version or break when a version leaves the archive. Weigh both and pick a refresh routine.
Oct 18, 20264 min read
Developer Tools
Should you commit the PHP vendor directory to git?
The Composer FAQ says no: ignore vendor, commit composer.lock, and install on each build. Reasons, the exceptions, and how to audit what you deploy.
Oct 18, 20263 min read
Developer Tools
Should you commit poetry.lock? Applications versus libraries
Commit poetry.lock for applications so every install matches. For libraries the advice differs. See why, and what changes when the file is out of sync.
Oct 18, 20263 min read
Developer Tools
Should you commit Package.resolved for a Swift project?
Commit it for apps and other top-level projects. For a library it does not pin anything for your users. What SwiftPM docs say and what it means for scans.
Oct 18, 20263 min read
Developer Tools
Should you commit node_modules to git? Vendoring vs zero-installs
Committing node_modules is rarely the right way to pin dependencies. Compare lockfile installs, Yarn zero-installs and vendoring, and the review each needs
Oct 18, 20263 min read
Developer Tools
Should you bundle the AWS SDK in your Lambda package?
AWS recommends packaging the SDK with your function. The reasons are control, compatibility and an honest dependency list. Trade offs and exceptions.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.