Developer Tools
SARIF fields that matter when you compare static analysis tools
Which SARIF properties to check in a SAST trial export: fingerprints, baseline state, suppressions, code flows and upload limits on your platform.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
How do you update dependencies safely with weak test coverage?
With thin tests, shrink each change, add smoke tests on critical paths, roll out gradually and keep a fast rollback. Patch first, majors last.
Oct 18, 20263 min read
Developer Tools
Rust ownership rules and the memory bugs they prevent
Three ownership rules let the Rust compiler stop double free and use of moved values at compile time. Here are the rules, with a short worked example.
Oct 18, 20264 min read
Developer Tools
Node, Java, Python, .NET, Go: how long is each runtime supported?
Support length ranges from about a year for Go to five years for Python. A side by side comparison of the five rules, with the dates that matter now.
Oct 18, 20263 min read
Developer Tools
Which runtime versions change support status before the end of 2026?
Node.js 24 enters Maintenance on 20 Oct, Node.js 26 reaches LTS on 28 Oct, and .NET 8 and 9 end on 10 Nov. A dated calendar from official sources.
Oct 18, 20263 min read
Developer Tools
How do you run your first OSV-Scanner scan in five minutes?
Install OSV-Scanner, point it at a lockfile or a directory, read the output and decide what to fix. A short walkthrough with the exact commands.
Oct 18, 20263 min read
Developer Tools
How do you run bundler-audit in CI for a Rails app?
Run bundle-audit check --update in CI to test Gemfile.lock against known advisories. Steps, ignore rules, JSON output and what the scan cannot tell you.
Oct 18, 20263 min read
Developer Tools
How do you route a security finding to the right engineering team?
Route findings by code ownership, not by a security queue. Use CODEOWNERS or a service catalog, a fallback owner and a clock, so each finding has one name.
Oct 18, 20263 min read
Developer Tools
How do you route SAST and DAST findings to the right owner?
Route each finding to the team that owns the code, using ownership files, repository mapping and service catalogs, with a fallback for unowned code.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.