Developer Tools
Which lockfile do I commit for each ecosystem?
A table of the file that pins exact dependency versions for npm, Cargo, Python, Go and Maven, and whether to commit it, drawn from each tool's own docs.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Which iframe sandbox tokens does a store widget need?
A sandboxed iframe starts with every restriction on. Learn which tokens a review, chat or payment widget needs and which combination undoes the sandbox.
Oct 19, 20264 min read
Developer Tools
Which GitHub environment protections should a payments deploy use?
Use required reviewers with self-review blocked, limit deployable branches, add a wait timer, and decide who can bypass. Here is what each setting does.
Oct 19, 20264 min read
Developer Tools
Which GitHub Actions trigger should a security automation use?
Compare pull_request, push, schedule, workflow_dispatch and repository_dispatch for security jobs, with what each can see, run from and risk.
Oct 19, 20263 min read
Developer Tools
Which frontend dependency updates are safe to automerge?
Automerge patch updates to dev tooling when tests, visual checks and a scan pass. Keep runtime UI dependencies and majors under review. A policy table.
Oct 19, 20263 min read
Developer Tools
Which frameworks serve API docs by default? Four compared
FastAPI serves docs out of the box. Spring needs springdoc and NestJS needs setup. Rails API mode has none. A table of default paths and the off switches.
Oct 19, 20263 min read
Developer Tools
Which files to commit in a WordPress project using Composer and npm?
Commit composer.json, composer.lock, package.json and package-lock.json. Leave out vendor, node_modules and built output unless your deploy needs them.
Oct 19, 20264 min read
Developer Tools
Which fastlane CI environment variables are secrets?
Several variables fastlane reads on CI hold passwords or session tokens. Here is which to store as secrets, which are just settings, and how to limit them.
Oct 19, 20263 min read
Developer Tools
Which ESLint rules flag XSS sinks in React and Vue code?
react/no-danger, vue/no-v-html, no-eval and related rules catch common XSS sinks early. What each flags, how to configure it and what lint cannot see.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.